CVE-2025-12524

MEDIUM

Post Type Switcher <4.0.0 - Insecure Direct Object Reference

Title source: llm
STIX 2.1

Description

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact.

References (6)

Core 6

Scores

CVSS v3 5.4
EPSS 0.0007
EPSS Percentile 21.2%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
johnjamesjacoby/Post Type Switcher < 4.0.0
Published Nov 18, 2025
Tracked Since Feb 18, 2026