CVE-2025-12126CWE-639

CVE-2025-12126

Medium · published November 11, 2025

CVSS v3.1

5.4

EPSS

Percentile

10.9

In the wild

Unconfirmed

What it is

The The Total Book Project plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 1.0 via several functions due to missing validation on a user controlled key. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform several actions like moving/deleting/creating chapters in books that do not belong to them.

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0: Not supplied
EPSS: 0.00212 · 10.9th percentile
Weakness: CWE-639 · Authorization Bypass Through User-Controlled Key
Published: 2025-11-11T09:15Z

References (3)

https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3392629%40the-total-book-project&new=3392629%40the-total-book-project · [email protected]https://wordpress.org/plugins/the-total-book-project/ · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/e1b473fd-2444-4a54-b558-4656634a6903?source=cve · [email protected]

EPSS history

Timeline

11 NOV 03:30Z
The Total Book Project <= 1.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Book Manipulation
cvelistv5