CVE-2024-1093 is a missing authorization vulnerability (CWE-862) in the Change Memory Limit plugin for WordPress (simon99). The admin_logic() function, triggered on admin_init, lacks a capability check, allowing unauthenticated attackers to update the memory limit setting. This vulnerability affects all versions up to and including 1.0. The CVSS 3.1 score is 5.3 (medium severity) with vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N, indicating network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, but low integrity impact.

An unauthenticated attacker can modify the memory limit setting of the WordPress environment via the vulnerable plugin. While this does not directly impact confidentiality or availability, it allows unauthorized integrity modification of configuration data, which could potentially lead to further issues depending on how the memory limit setting is used.

No official patch or remediation is currently available from the vendor. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider disabling or removing the Change Memory Limit plugin if it is not essential. Restricting access to the WordPress admin area and applying general security best practices may help reduce exposure, but these are not direct mitigations for this specific vulnerability.