What’s Vulnerable › Vulnerabilities

CVE-2021-24347: SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 54.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-06-14 · updated 2026-06-17
• Weakness: CWE-178

Description

The SP Project & Document Manager WordPress plugin before 4.22 allows users to upload files, however, the plugin attempts to prevent php and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that php files could still be uploaded by changing the file extension's case, for example, from "php" to "pHP".

Affected products

• Smartypants SP Project & Document Manager: before 4.22 — fixed in 4.22

How to fix

Upgrade to a fixed version: Smartypants SP Project & Document Manager 4.22. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html
• http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html
• https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a
• http://packetstormsecurity.com/files/163434/WordPress-SP-Project-And-Document-Manager-4.21-Shell-Upload.html
• http://packetstormsecurity.com/files/163675/WordPress-SP-Project-And-Document-Remote-Code-Execution.html
• https://wpscan.com/vulnerability/8f6e82d5-c0e9-468e-acb8-7cd549f6a45a

Get alerted when CVE-2021-24347 or the next vulnerability affects your stack