CVE-2024-1693

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-1693
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cdm_save_category AJAX action in all versions up to, and including, 4.70. This makes it possible for authenticated attackers, with subscriber-level access and above, to update arbitrary folder name that do not belong to them.

4.3 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786
https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve
https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786
https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve
Configurations

No configuration.

History

08 Apr 2026, 17:18

Type Values Removed Values Added
CWE CWE-639

21 Nov 2024, 08:51

Type Values Removed Values Added
References () https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786 - () https://plugins.trac.wordpress.org/browser/sp-client-document-manager/trunk/classes/ajax.php#L786 -
References () https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve - () https://www.wordfence.com/threat-intel/vulnerabilities/id/1951ad6c-17b5-44ae-85e2-376b99df742e?source=cve -
Summary
  • (es) El complemento SP Project & Document Manager para WordPress es vulnerable a modificaciones no autorizadas de datos debido a una falta de verificación de capacidad en la acción cdm_save_category AJAX en todas las versiones hasta la 4.70 incluida. Esto hace posible que atacantes autenticados, con acceso de nivel de suscriptor y superior, actualicen nombres de carpetas arbitrarios que no les pertenecen.

14 May 2024, 14:48

Type Values Removed Values Added
New CVE
Information

Published : 2024-05-14 14:48

Updated : 2026-04-15 00:35

NVD link : CVE-2024-1693

Mitre link : CVE-2024-1693

CVE.ORG link : CVE-2024-1693

JSON object : View

Products Affected

No product.

CWE
CWE-639

Authorization Bypass Through User-Controlled Key