Unauthorized Modification of Data in IdeaPush Plugin for WordPress

CVE-2024-11844

Summary

The IdeaPush plugin for WordPress exhibits a vulnerability that enables unauthorized modification of data. This flaw is due to a missing capability check in the idea_push_taxonomy_save_routine function, which affects all versions up to and including 8.71. Authenticated attackers, possessing Subscriber-level access or higher, can exploit this vulnerability to delete terms within the 'boards' taxonomy, potentially leading to significant data integrity issues. Website administrators using this plugin should assess their systems for unauthorized access and ensure timely updates to mitigate risks associated with this vulnerability.

References