CVE-2026-10737 is a missing authorization vulnerability (CWE-862) in the SP Project & Document Manager WordPress plugin affecting all versions up to 4.71. The issue is due to improper authorization logic in the view_file function, where a negated nonce check combined with OR logic allows unauthenticated attackers to bypass capability and ownership checks. As a result, attackers can retrieve metadata and download links for arbitrary files stored within project folders, excluding only root-level files. This vulnerability enables unauthorized file access without authentication by supplying a valid file ID in a POST request to admin-ajax.php.

An unauthenticated attacker can read sensitive file metadata and obtain download links for arbitrary files stored inside project folders on the server. This can lead to unauthorized disclosure of sensitive information. The vulnerability does not allow modification or deletion of files, nor does it affect availability. The CVSS 3.1 base score is 7.5, reflecting high impact on confidentiality with no impact on integrity or availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the admin-ajax.php endpoint and monitor for suspicious POST requests containing file IDs. Avoid exposing sensitive files in project folders and consider disabling or limiting the use of the vulnerable plugin version. Follow vendor updates closely for an official fix or temporary mitigation.