PT-2025-46273 · WordPress · The Total Book Project

Athiwat Tiprasaharn · Published 2025-11-11 · Updated 2025-11-11 · CVE-2025-12126

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Total Book Project plugin for WordPress versions prior to 1.1

Description The software is susceptible to an Insecure Direct Object Reference issue. This impacts authenticated attackers with Contributor-level access or higher, allowing them to perform unauthorized actions on books and chapters they do not own. The issue stems from a lack of validation on a user-controlled key within several functions.

Recommendations Update to version 1.1 or later.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12126

Affected Products

The Total Book Project

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12126 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392629%40the-total-book-project&new=3392629%40the-total-book-project · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve · Note
• https://wordpress.org/plugins/the-total-book-project · Note
• https://twitter.com/CVEnew/status/1988095300179747230 · Twitter Post