CVE-2025-12524

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-12524", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-10-30T16:41:14.529Z", "datePublished": "2025-11-18T06:43:09.582Z", "dateUpdated": "2026-04-08T17:26:52.747Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:26:52.747Z"}, "affected": [{"vendor": "johnjamesjacoby", "product": "Post Type Switcher", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "4.0.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact."}], "title": "Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469"}, {"url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486"}, {"url": "https://cwe.mitre.org/data/definitions/639.html"}, {"url": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail="}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-639 Authorization Bypass Through User-Controlled Key", "cweId": "CWE-639", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "baseScore": 5.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "timeline": [{"time": "2025-11-17T18:38:47.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-18T16:34:54.970263Z", "id": "CVE-2025-12524", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:35:04.840Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-12524", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-18T16:34:54.970263Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-18T16:34:59.108Z"}}], "cna": {"title": "Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change", "credits": [{"lang": "en", "type": "finder", "value": "Athiwat Tiprasaharn"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 5.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L"}}], "affected": [{"vendor": "johnjamesjacoby", "product": "Post Type Switcher", "versions": [{"status": "affected", "version": "*", "versionType": "semver", "lessThanOrEqual": "4.0.0"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-11-17T18:38:47.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469"}, {"url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486"}, {"url": "https://cwe.mitre.org/data/definitions/639.html"}, {"url": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail="}], "descriptions": [{"lang": "en", "value": "The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-639", "description": "CWE-639 Authorization Bypass Through User-Controlled Key"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2025-11-18T06:43:09.582Z"}}}, "cveMetadata": {"cveId": "CVE-2025-12524", "state": "PUBLISHED", "dateUpdated": "2025-11-18T16:35:04.840Z", "dateReserved": "2025-10-30T16:41:14.529Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-11-18T06:43:09.582Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Post Type Switcher", "vendor": "johnjamesjacoby", "versions": [{"lessThanOrEqual": "4.0.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact."}, {"lang": "es", "value": "El plugin Post Type Switcher para WordPress es vulnerable a Insecure Direct Object Reference en versiones hasta, e incluyendo, la 4.0.0 debido a la falta de validaci\u00f3n en una clave controlada por el usuario. Esto hace posible que atacantes autenticados, con acceso de nivel Autor y superior, modifiquen el tipo de publicaci\u00f3n de entradas y p\u00e1ginas arbitrarias que no les pertenecen, incluyendo aquellas creadas por administradores, lo que puede llevar a la interrupci\u00f3n del sitio, navegaci\u00f3n rota e impacto en el SEO."}], "id": "CVE-2025-12524", "lastModified": "2026-10-18T20:10:00.110", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 5.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.5, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-12524", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-18T16:34:54.970263Z", "version": "2.0.3"}}]}, "published": "2025-11-18T07:15:44.237", "references": [{"source": "security@wordfence.com", "url": "https://cwe.mitre.org/data/definitions/639.html"}, {"source": "security@wordfence.com", "url": "https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail="}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-639"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-21T18:19:27.052530+00:00", "value": {"mitigation_remediation": ["Upgrade the Post Type Switcher plugin to the latest available version that addresses the insecure direct object reference.", "If an updated version is not available, consider disabling or uninstalling the plugin.", "Apply the principle of least privilege by restricting Author\u2011level users from accessing post\u2011type\u2011change functionality, or re\u2011implement the authorization check in the plugin code.", "Monitor site logs for unexpected post\u2011type changes to detect and respond to any unauthorized activity."], "summary": {"action": "Patch", "impact": "Unauthorized Change of Post Types"}, "threat_synthesis": {"affected_systems": "WordPress installations running the Post Type Switcher plugin version 4.0.0 or earlier are affected. Administrators who have deployed these versions should review the plugin\u2019s version and consider updating or disabling it.", "description_and_impact": "The Post Type Switcher plugin for WordPress contains an insecure direct object reference that lets authenticated users with Author role or higher alter the post type of any post or page they don\u2019t own. The flaw permits the attacker to reclassify arbitrary content, which can break navigation, cause site disruption, and harm SEO. This weakness aligns with CWE\u2011639, a lack of fine\u2011grained authorization.", "risk_and_exploitability": "With a CVSS score of 5.4 the vulnerability is moderately severe. The EPSS score of less than 1% indicates a very low probability that attackers are already exploiting it, and it is not listed in CISA\u2019s KEV catalog. Likely exploitation requires the attacker to be a logged\u2011in user with Author or higher privileges and to know the identifier of the target post or page. Because no remote code execution or privilege escalation is involved, the impact is limited to content modification and associated site disruption."}}}}, "created": "2025-11-18T14:15:57.903630+00:00", "updated": "2026-04-21T18:30:27.580121+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}