CVE-2024-1693 is an authorization bypass vulnerability in the SP Project & Document Manager plugin for WordPress. The issue arises because the cdm_save_category AJAX action lacks proper capability checks, enabling authenticated users with low privileges (subscriber-level and above) to update arbitrary folder names they do not own. This vulnerability affects all versions up to and including 4.70. The CVSS 3.1 base score is 4.3, indicating medium severity, with an attack vector of network, low attack complexity, and requiring privileges but no user interaction.

The vulnerability allows authenticated users with subscriber-level access or higher to modify folder names arbitrarily within the plugin, leading to unauthorized data modification. There is no impact on confidentiality or availability reported. No known exploits are currently in the wild.

Patch status is not yet confirmed as no official patch or vendor advisory is provided. Users should monitor the vendor's official channels for updates and apply any forthcoming patches promptly. Until a patch is available, restrict user roles and permissions to trusted users only to minimize risk.