What’s Vulnerable › Vulnerabilities

CVE-2021-4225: SP Project & Document Manager < 4.24 - Subscriber+ Shell Upload

• Severity: high (CVSS 8.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-04-25 · updated 2026-06-17
• Weakness: CWE-434

Description

The SP Project & Document Manager WordPress plugin before 4.24 allows any authenticated users, such as subscribers, to upload files. The plugin attempts to prevent PHP and other similar files that could be executed on the server from being uploaded by checking the file extension. It was discovered that on Windows servers, the security checks in place were insufficient, enabling bad actors to potentially upload backdoors on vulnerable sites.

Affected products

• Smartypants SP Project & Document Manager: before 4.24 — fixed in 4.24

How to fix

Upgrade to a fixed version: Smartypants SP Project & Document Manager 4.24. Check the vendor advisory for mitigations.

References

• https://github.com/pang0lin/CVEproject/blob/main/wordpress_SP-Project_fileupload.md
• https://wpscan.com/vulnerability/bd1083d1-edcc-482e-a8a9-c8b6c8d417bd
• https://github.com/pang0lin/CVEproject/blob/main/wordpress_SP-Project_fileupload.md
• https://wpscan.com/vulnerability/bd1083d1-edcc-482e-a8a9-c8b6c8d417bd

Get alerted when CVE-2021-4225 or the next vulnerability affects your stack