PatchTheCVECVE-2024-11844: The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili
CVE-2024-11844 is a medium-severity flaw (CVSS 4.3) affecting ideapush. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine function in all versions up to, and including, 8.71. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete terms for the "boards" taxonomy.
Why this priority
- No elevated risk signals yet
A fixed release or distro patch exists.
Risk facts
| CVSS score | 4.3 (Medium) |
| Attack vector | Network (remote) |
| Attack complexity | Low |
| Privileges needed | Low |
| User interaction | None |
| EPSS exploit chance | 0.3% (top 72%) |
| CISA exploited list | No |
| Weakness | CWE-862 |
| Published | 2024-12-03 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-11844?
ideapush: upgrade to 8.72. Exact commands for each OS are on this page.
Is CVE-2024-11844 being exploited?
CVE-2024-11844 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-11844 affect?
CVE-2024-11844 affects ideapush. Severity is medium (CVSS 4.3). The IdeaPush plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the idea_push_taxonomy_save_routine function in all versions up to, and including, 8.71. This makes it possible for au
How urgent is CVE-2024-11844?
Priority 22/100. No elevated risk signals yet.
Software pages
Related CVEs
- CVE-2025-24607 MEDIUM 5.8 UPGRADE Missing Authorization vulnerability in Northern Beaches Websites IdeaPush ideapush allows Exploiting Incorrect
- CVE-2024-49275 MEDIUM 4.3 UPGRADE Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Si
- CVE-2024-44041 MEDIUM 5.9 UPGRADE Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Northern
- CVE-2024-37461 HIGH 7.1 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in M
- CVE-2024-37265 MEDIUM 6.5 UPGRADE Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in M