Access violation vulnerability in SP Project & Document Manager 4.71

The SP Project & Document Manager plugin for WordPress has a security issue that affects all versions up to and including 4.71. This vulnerability, known as Insecure Direct Object Reference, is caused by a lack of validation on a key that can be controlled by a user. As a result, attackers who are logged in with Subscriber-level access or higher can access and download files belonging to other users.