CVE-2024-1093: Simon99 Change Memory Limit Auth Bypass

CVE-2024-1093 Overview

The Change Memory Limit plugin for WordPress contains a missing authorization vulnerability in the admin_logic() function hooked via admin_init. All versions up to and including 1.0 are affected. The function lacks a capability check, allowing unauthenticated attackers to modify the PHP memory limit setting managed by the plugin. The flaw is classified under CWE-862: Missing Authorization. Wordfence tracks this issue under vulnerability profile eee7344d-5459-4558-a557-d8c5935ecc30.

Critical Impact
Unauthenticated remote attackers can alter the WordPress memory limit configuration on any site running the vulnerable plugin, resulting in unauthorized data modification.

Affected Products

Simon99 Change Memory Limit plugin for WordPress, version 1.0
All prior versions of the Change Memory Limit plugin
WordPress sites with the plugin active and reachable over the network

Discovery Timeline

2024-03-05 - CVE-2024-1093 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1093

Vulnerability Analysis

The Change Memory Limit plugin exposes administrative logic through the admin_init action hook. WordPress fires admin_init on every request to an /wp-admin/ endpoint, including admin-ajax.php and admin-post.php, which are reachable without authentication. The plugin's admin_logic() handler processes state-changing input without verifying the caller's capabilities or validating a nonce. As a result, any unauthenticated visitor who sends the expected request parameters can trigger the memory limit update path. The impact is limited to integrity of the plugin's configuration, and there is no direct confidentiality or availability loss reported.

Root Cause

The root cause is a missing authorization check in admin_logic() inside change-mem-limit.php (see line 104 of the plugin trunk). The function neither calls current_user_can() to enforce an administrator capability such as manage_options, nor verifies a nonce via check_admin_referer() or wp_verify_nonce(). Registering the handler on admin_init compounds the issue by making the code path reachable from unauthenticated admin endpoints.

Attack Vector

An attacker sends a crafted HTTP request to an unauthenticated /wp-admin/ endpoint on the target site, supplying the parameters the plugin expects when updating the memory limit. Because no session, capability, or nonce is required, the request succeeds against any site running the vulnerable version. Technical details are documented in the plugin source on WordPress Plugin Trac and the Wordfence vulnerability profile. No public proof-of-concept exploit is currently listed.

Detection Methods for CVE-2024-1093

Indicators of Compromise

Unexpected changes to the PHP memory limit value written by the plugin or to related options in the wp_options table.
Unauthenticated POST requests to /wp-admin/admin-post.php or /wp-admin/admin-ajax.php containing parameters associated with the Change Memory Limit plugin.
Presence of the change-memory-limit plugin directory at version 1.0 or earlier under wp-content/plugins/.

Detection Strategies

Inventory WordPress installations and flag sites where the Change Memory Limit plugin is installed and active.
Review web server access logs for requests to admin endpoints that lack a valid authenticated session cookie yet result in HTTP 200 responses.
Compare current plugin configuration values against a known-good baseline to identify unauthorized modifications.

Monitoring Recommendations

Alert on writes to wp_options keys managed by the plugin outside of authorized administrator sessions.
Monitor for spikes in unauthenticated traffic to admin-post.php and admin-ajax.php on WordPress properties.
Track plugin inventory drift and new installations of unmaintained plugins across managed WordPress fleets.

How to Mitigate CVE-2024-1093

Immediate Actions Required

Deactivate and remove the Change Memory Limit plugin from all WordPress instances where it is installed.
Audit wp_options and the plugin's stored settings for unauthorized modifications and restore known-good values.
Restrict access to /wp-admin/ paths at the network or web server layer where feasible.

Patch Information

No patched version has been published by the vendor. Version 1.0 remains the latest release of the Change Memory Limit plugin, and the Wordfence advisory does not list a fixed release. Removal is the recommended remediation.

Workarounds

Replace the plugin by setting WP_MEMORY_LIMIT directly in wp-config.php or memory_limit in php.ini, then uninstall the plugin.
Deploy a web application firewall rule to block unauthenticated requests carrying the plugin's parameters to admin endpoints.
Enforce HTTP authentication on /wp-admin/ while planning migration away from the abandoned plugin.

bash

# Configuration example: set memory limit without the vulnerable plugin
# Add to wp-config.php above the "That's all, stop editing!" line
define( 'WP_MEMORY_LIMIT', '256M' );
define( 'WP_MAX_MEMORY_LIMIT', '512M' );

# Then remove the vulnerable plugin from the server
wp plugin deactivate change-memory-limit
wp plugin delete change-memory-limit