CVE-2024-1807 is a missing authorization vulnerability (CWE-862) in the Product Sort and Display for WooCommerce plugin for WordPress. The issue arises because the psad_update_product_cat_custom_meta_ajax function lacks a capability check, enabling unauthenticated attackers to hide product categories by modifying plugin data. This affects all versions up to and including 2.4.1. The vulnerability has a CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L), reflecting network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality impact, limited integrity impact, and limited availability impact.

An unauthenticated attacker can exploit this vulnerability to hide product categories in the affected WooCommerce plugin, resulting in unauthorized modification of data. This could disrupt the normal display and sorting of products on a WordPress site using this plugin. There is no direct confidentiality impact, but integrity and availability impacts are rated as low to medium due to unauthorized data changes and potential disruption of product visibility.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, site administrators should consider disabling or restricting access to the affected plugin functions or monitor for suspicious activity related to product category modifications. Avoid exposing the plugin's AJAX endpoints to unauthenticated users if possible.