CVE-2024-49275 MEDIUM

CVE-2024-49275: WordPress IdeaPush plugin <= 8.69 - Cross Site Request Forgery (CSRF) vulnerability

Vendor Northern Beaches Websites
Product IdeaPush
Weakness CWE-352 · CSRF
Published October 20, 2024
Last update April 28, 2026
View on NVD All CVEs

CVSS base score

4.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction Required
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

What the vulnerability does

01Description

Cross-Site Request Forgery (CSRF) vulnerability in Northern Beaches Websites IdeaPush ideapush allows Cross Site Request Forgery.This issue affects IdeaPush: from n/a through <= 8.69.

Explanation of Vulnerability in Simple Terms

02Summary

IdeaPush versions 8.69 and earlier are vulnerable to cross-site request forgery (CSRF) attacks. An attacker can craft a malicious webpage that, when visited by a logged-in IdeaPush user, performs unwanted actions on their behalf without their knowledge. The vulnerability requires user interaction—the victim must visit the attacker's page while authenticated. Impact is limited to data modification; no data theft or system compromise occurs.

What an attacker can do

03Attacker Capabilities

Perform unwanted actions on an IdeaPush user's account by tricking them into visiting a malicious webpage.

Potential impact on your site

04Site Impact

Users' IdeaPush accounts can be manipulated without their consent if they visit untrusted sites while logged in.

Conditions required to exploit

05Prerequisites

Victim must be logged into IdeaPush and visit an attacker-controlled webpage.

Key dates

06Disclosure timeline

October 20, 2024 CVE published
April 28, 2026 Record updated

Related vulnerabilities

08Related CVE

CVE-2026-8910 WP Emoticon Rating <= 1.0.1 - Cross-Site Request Forgery to Reflected Cross-Site Scripting via 'emo_settings' Parameter CVE-2026-8903 Two-factor authentication (formerly IP Vault) <= 2.1 - Cross-Site Request Forgery to Settings Update CVE-2016-20074 WordPress Lazy Content Slider Plugin 3.4 CSRF CVE-2026-8708 Genzel breadcrumbs <= 1.2 - Cross-Site Request Forgery to Settings Update via Plugin Settings Page CVE-2026-9599 Tectite Forms <= 1.3 - Cross-Site Request Forgery to Settings Update