SP Project & Document Manager <2 4.22 - Authenticated Shell Upload

Vulnerability

The SP Project & Document Manager WordPress plugin before version 4.22 contains a file upload vulnerability. The plugin attempts to block dangerous file types such as PHP by checking the file extension, but the check is case-sensitive. An attacker can upload a file with a mixed-case extension (e.g., .pHP) that bypasses the filter while the server may still execute it as PHP. This affects all versions prior to 4.22 [1].

Exploitation

An attacker must be an authenticated user with file upload permissions. They can craft a PHP file with a manipulated extension (e.g., shell.pHP) and upload it through the plugin's interface. The server, depending on its configuration, may execute the file as PHP, allowing the attacker to run arbitrary code. The WPScan advisory includes a proof of concept [1].

Impact

Successful exploitation enables arbitrary PHP code execution on the server. This can lead to full compromise of the WordPress site, including data theft, defacement, malware injection, and further attacks on the underlying infrastructure.

Mitigation

The vulnerability is fixed in version 4.22 of the SP Project & Document Manager plugin. Users should update to 4.22 or later immediately. No workaround is documented. The plugin is not listed on the CISA Known Exploited Vulnerabilities catalog [1].