CVE-2021-24347: WordPress SP Project & Document Manager case-insensitive extension check allows PHP upload

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityRemote code execution with low privileges, public exploit code and very high EPSS, though not confirmed in KEV.

What it is

The SP Project & Document Manager WordPress plugin before 4.22 blocks executable uploads by checking the file extension, but the check is case-sensitive. An attacker can bypass it by changing the extension case, for example "php" to "pHP", and upload a PHP file that the server then executes. This matters because it turns a file-upload feature into remote code execution on the web server.

Impact

An attacker with a low-privileged account can upload and execute arbitrary PHP, leading to full compromise of the WordPress host with high confidentiality, integrity and availability impact.

Attack surface

Reached over the network through the plugin's file upload functionality; the CVSS vector requires low privileges (PR:L) and no user interaction (UI:N). No authentication bypass is needed beyond a valid low-privileged account.

Exploitation

Not listed in CISA KEV, but public exploit references exist (Packet Storm shell upload and remote code execution write-ups, WPScan) and EPSS is 0.5408 (98.9th percentile), indicating high likelihood of exploitation.

What to do

• Update the SP Project & Document Manager plugin to version 4.22 or later.
• If patching is not immediately possible, disable or remove the plugin.
• Restrict upload permissions to trusted roles and review accounts with upload capability.
• Enforce server-side upload validation that normalizes extension case and blocks executable types.
• Configure the web server to deny execution in upload directories.

Detection

• Monitor upload directories for newly written files with PHP-related extensions in any case variation.
• Alert on HTTP requests to uploaded files that return executable content or spawn server processes.
• Review web server logs for POST requests to the plugin's upload endpoints followed by access to the uploaded path.
• Check for unexpected PHP files in WordPress uploads and compare against known-good baselines.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.