The SP Project & Document Manager WordPress plugin up to and including 4.71 lacks proper access controllers and allows a logged in user to view and download files belonging to another user