CVE-2025-12126

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12126", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-23T18:32:44.001Z", "datePublished": "2025-11-11T03:30:50.707Z", "dateUpdated": "2026-04-08T17:28:59.902Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:59.902Z"}, "affected": [{"vendor": "ryanmoyer", "product": "The Total Book Project", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "1.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them."}], "title": "The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve"}, {"url": "https://wordpress.org/plugins/the-total-book-project/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392629%40the-total-book-project&new=3392629%40the-total-book-project"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-10T15:18:41.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-12T15:10:40.924379Z", "id": "CVE-2025-12126", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T20:05:05.807Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12126", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-12T15:10:40.924379Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-12T15:10:43.675Z"}}], "cna": {"title": "The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N"}}], "affected": [{"vendor": "ryanmoyer", "product": "The Total Book Project", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "1.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-10T15:18:41.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve"}, {"url": "https://wordpress.org/plugins/the-total-book-project/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392629%40the-total-book-project&new=3392629%40the-total-book-project"}], "descriptions": [{"lang": "en", "value": "The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:28:59.902Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12126", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:28:59.902Z", "dateReserved": "2025-10-23T18:32:44.001Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-11T03:30:50.707Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "The Total Book Project", "vendor": "ryanmoyer", "versions": [{"lessThanOrEqual": "1.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them."}, {"lang": "es", "value": "El plugin The Total Book Project para WordPress es vulnerable a Referencia Directa Insegura a Objeto en todas las versiones hasta la 1.0, inclusive, a trav\u00e9s de varias funciones debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador o superior, realicen varias acciones como mover/eliminar/crear cap\u00edtulos en libros que no les pertenecen."}], "id": "CVE-2025-12126", "lastModified": "2026-10-07T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12126", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-12T15:10:40.924379Z", "version": "2.0.3"}}]}, "published": "2025-11-11T04:15:46.333", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392629%40the-total-book-project&new=3392629%40the-total-book-project"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/the-total-book-project/"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T01:42:18.203034+00:00", "value": {"mitigation_remediation": ["Update the Total Book Project plugin to the newest release that addresses the IDOR issue.", "Review and revise WordPress member roles so that contributors cannot modify books; restrict to lower roles if possible.", "Add custom or plugin-level permission checks that verify that a user is the owner of the book before allowing chapter creation, editing or deletion.", "If the plugin is unnecessary, consider disabling or uninstalling it to remove the attack surface."], "summary": {"action": "Apply Patch", "impact": "Unauthorized manipulation of book chapters by authenticated attacker with Contributor level or higher"}, "threat_synthesis": {"affected_systems": "This flaw affects the WordPress plugin The Total Book Project authored by Ryan Moyer, in all released versions through 1.0. Users running any version of the plugin on a WordPress installation are potentially vulnerable until the license is updated to a version beyond 1.0.", "description_and_impact": "The vulnerability is an insecure direct object reference in all versions up to and including 1.0 of the Total Book Project plugin for WordPress. The absence of validation on a user\u2011controlled key allows an authenticated user with Contributor or higher privileges to move, delete, or create chapters for books that do not belong to them. This directly compromises the integrity of those books, allowing attackers to alter, destroy, or inject content outside of their own scope. The weakness aligns with CWE\u2011639.", "risk_and_exploitability": "The CVSS base score is 5.4, indicating moderate risk. The EPSS score is below 1%, suggesting a low exploitation probability but not zero. The vulnerability is not listed in the CISA KEV catalog, which implies it has not yet been exploited in the wild at the time of this analysis. Successful exploitation requires an authenticated account with Contributor level or higher and likely involves interacting with the plugin\u2019s administrative interfaces to craft requests that reference the protected book objects."}}}}, "created": "2025-11-12T12:42:54.838429+00:00", "updated": "2026-04-21T01:45:24.447279+00:00", "vendors": ["ryanmoyer", "ryanmoyer$PRODUCT$the_total_book_project", "wordpress", "wordpress$PRODUCT$wordpress"]}