CVE-2024-11844 is a missing authorization vulnerability (CWE-862) in the IdeaPush WordPress plugin by northernbeacheswebsites. The flaw exists in the idea_push_taxonomy_save_routine function, which lacks a capability check, enabling authenticated users with low privileges (Subscriber and above) to delete taxonomy terms for "boards". This unauthorized modification could affect site content integrity. The vulnerability affects all versions up to and including 8.71. The CVSS 3.1 base score is 4.3 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N). No known exploits are reported in the wild, and no patch or vendor advisory is currently available.

An attacker with at least Subscriber-level access can delete terms in the "boards" taxonomy without proper authorization. This results in unauthorized modification of site data, potentially disrupting site organization or content categorization. There is no impact on confidentiality or availability according to the CVSS vector. The overall impact is limited to integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict user roles and capabilities to trusted users only, minimizing the number of users with Subscriber-level or higher access. Monitor plugin updates from northernbeacheswebsites for an official fix.