CVE-2026-10737 is a missing authorization vulnerability (CWE-862) in the SP Project & Document Manager plugin for WordPress, affecting all versions up to 4.71. The issue is in the view_file function where the authorization logic incorrectly uses a negated nonce check OR-chained with permission checks. This logic flaw causes the entire authorization condition to evaluate to true if the nonce is missing or invalid, effectively bypassing capability and ownership checks. Consequently, unauthenticated attackers can retrieve file metadata and download links for arbitrary files stored inside project folders, except for root-level files which have a fallback access denial. Exploitation requires only a valid file ID in a POST request to admin-ajax.php.

An unauthenticated attacker can access sensitive file metadata and download links for arbitrary files stored within project folders on the server. This exposure can lead to unauthorized disclosure of sensitive information. The vulnerability does not allow modification or deletion of files, but the confidentiality of stored data is compromised. Root-level files are protected, but all other files in project folders are accessible without authentication.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to admin-ajax.php and project folder files through web server configuration or other access control mechanisms to prevent unauthorized file access. Monitor for updates from the vendor regarding patches or official mitigations.