CVE-2025-24607: Medium Access Control Flaw in IdeaPush Plugin

CVE-2025-24607 is a medium severity missing authorization flaw (CVSS 5.8) in the IdeaPush WordPress plugin, versions up to and including 8.71. The record names no fixed version, so update to the newest release, confirm the issue is marked fixed, and remove the plugin if it is unused.

What's affected

The NVD record names the IdeaPush plugin by Northern Beaches Websites, in versions from n/a through 8.71. That wording means every release up to 8.71 is affected, and the record does not say which release fixes it. The weak check affects integrity at a limited level, and the vector marks scope as changed, which means the effect can reach beyond the plugin itself. Read the Patchstack entry for details.

The record is not on the CISA Known Exploited Vulnerabilities list.

The weakness is classed as CWE-862 (missing authorization). The score is 5.8 (MEDIUM). The vector, CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:N, reads as reachable over the network, low attack complexity, no privileges required and no user interaction. Impact is no on confidentiality, limited on integrity and no on availability. The record was published on 2025-02-14.

The record gives no fixed version. The reference is a Patchstack database entry that I could not retrieve, so open it and the plugin's changelog page. A release newer than 8.71 is where to look, and the changelog should mention access control or authorization.

How to check if you're exposed

WordPress makes this check easy, with or without command line access.

1. In the dashboard, open Plugins, then Installed Plugins, and find IdeaPush. The version is listed under its name.
2. With WP-CLI on the server, list the version and whether an update is waiting.

wp plugin list --fields=name,version,update | grep -i ideapush

3. If the version is 8.71 or lower, you are in the affected range.
4. On multisite, run the same list on each site, since each can have its own plugin state.
5. If you manage many sites, search your management tool or hosting panel for the plugin slug ideapush.

What to do now

1. Update the IdeaPush plugin to the latest release.
2. Read the changelog and the Patchstack entry to confirm the access control issue is marked as fixed in the version you installed.
3. If you do not use the plugin, deactivate and delete it. A removed plugin cannot be attacked.
4. Review your site for unexpected changes made through the plugin's features, and check user accounts and roles.
5. Turn on automatic updates for plugins you rely on, or add them to a regular patch schedule.

Why it matters

Missing authorization, listed as CWE-862, means a feature works for callers who should not be allowed to use it. In WordPress plugins this often shows up as an action handler that never checks the visitor's role or a security token, so a request from a logged out user, or a low privileged one, is treated like an admin request.

The score is 5.8, which reflects limited integrity or availability impact and no need for credentials in the vector. That is a small number on its own. Across thousands of sites, though, small flaws are what automated scanners look for first, because the plugin slug and version are easy to read from a page. Keeping plugins updated and short is the cheap defence.

If you track many applications, the free in-browser dependency scan at gold.safeguard.sh/scan can show which of your components have known CVEs, and the Gold directory lists each one with its fix status.

Quick check

Sources

• Safeguard Gold entry for CVE-2025-24607
• NVD record data for CVE-2025-24607 (published 2025-02-14)
• Patchstack database entry (listed in the record, could not be retrieved)

Last reviewed: 19 October 2026.