CVE-2023-3063: 
WordPress vulnerability analysis and mitigation

The SP Project & Document Manager plugin for WordPress contains an Insecure Direct Object References vulnerability (CVE-2023-3063) affecting versions up to and including 4.67. The vulnerability was discovered and disclosed on June 29, 2023. This security flaw impacts the plugin's user access control mechanisms (NVD CVE).

The vulnerability stems from the plugin's improper implementation of access controls, where it provides user-controlled access to objects without proper authorization checks. The severity of this vulnerability is rated as HIGH with a CVSS v3.1 Base Score of 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) (Wordfence Intel).

The vulnerability allows authenticated attackers with subscriber privileges or higher to bypass authorization controls and access system resources. Most critically, attackers can exploit this flaw to change user passwords and potentially gain unauthorized administrative access to the affected WordPress installations (NVD CVE).

Users should immediately update their SP Project & Document Manager plugin to a version newer than 4.67. The vulnerability has been patched in subsequent releases (NVD CVE).