CVE-2024-11844 IdeaPush <= 8.71 - Missing Authorization to Board Term Deletion

What is CVE-2024-11844?

CVE-2024-11844 is a medium-severity missing authorization vulnerability in northernbeacheswebsites IdeaPush, published on 3 Dec 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete terms for the "boards" taxonomy.

Weakness: CWE-862

Which versions are affected by CVE-2024-11844?

It affects 1 product.

Products include Northernbeacheswebsites Ideapush.

How do I fix CVE-2024-11844?

No fix has been published for CVE-2024-11844 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2024-11844 being exploited?

There is no known exploitation of CVE-2024-11844 in the wild and no public exploit code.

Other vulnerabilities in northernbeacheswebsites IdeaPush

• CVE-2024-37461 WordPress IdeaPush plugin <= 8.65 - Cross Site Scripting (XSS) vulnerability High 7.1
• CVE-2024-37265 WordPress IdeaPush plugin <= 8.60 - Cross Site Scripting (XSS) vulnerability Medium 6.5
• CVE-2024-44041 WordPress IdeaPush plugin <= 8.66 - Cross Site Scripting (XSS) vulnerability Medium 5.9
• CVE-2023-47181 WordPress IdeaPush Plugin <= 8.52 is vulnerable to Cross Site Scripting (XSS) Medium 5.9
• CVE-2025-24607 WordPress IdeaPush plugin <= 8.71 - Broken Access Control vulnerability Medium 5.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-j66f-9h25-hw6j.