PT-2025-47243 · WordPress · Post Type Switcher

Athiwat Tiprasaharn · Published 2025-11-18 · Updated 2025-11-18 · CVE-2025-12524

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Post Type Switcher plugin for WordPress versions up to and including 4.0.0

Description The software contains an Insecure Direct Object Reference issue because of missing validation on a user-controlled key. Authenticated attackers with Author-level access or higher can modify the post type of posts and pages they do not own, even those created by administrators. This can result in site disruption, broken navigation, and SEO impact.

Recommendations Update Post Type Switcher plugin to a version newer than 4.0.0.

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-12524

Affected Products

Post Type Switcher

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2025-12524 · Security Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/VulmonFeeds/status/1990692739264946203 · Twitter Post
• https://twitter.com/CVEnew/status/1990680533190520979 · Twitter Post
• https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486 · Note
• https://cwe.mitre.org/data/definitions/639.html · Note
• https://t.me/cveNotify/143146 · Telegram Post
• https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization · Note