CVE-2025-12524

MEDIUM 5.4

Post Type Switcher <= 4.0.0 - Insecure Direct Object Reference to Authenticated (Author+) Post Type Change

CVSS Score

5.4

EPSS Score

0.0%

EPSS Percentile

0th

The Post Type Switcher plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 4.0.0 due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Author-level access and above, to modify the post type of arbitrary posts and pages they do not own, including those created by administrators, which can lead to site disruption, broken navigation, and SEO impact.

CWE	CWE-639
Vendor	johnjamesjacoby
Product	post type switcher
Published	Nov 18, 2025
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for johnjamesjacoby post type switcher

Be the first to know when new medium vulnerabilities affecting johnjamesjacoby post type switcher are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

johnjamesjacoby / Post Type Switcher

0 ≤ 4.0.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d875514c-c7d3-4236-842b-6e772048448d?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L469 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/post-type-switcher/tags/4.0.0/post-type-switcher.php#L486 cwe.mitre.org: https://cwe.mitre.org/data/definitions/639.html owasp.org: https://owasp.org/API-Security/editions/2023/en/0xa1-broken-object-level-authorization/ plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3391983%40post-type-switcher%2Ftrunk&old=3331072%40post-type-switcher%2Ftrunk&sfp_email=&sfph_mail=

Credits

Athiwat Tiprasaharn