CVE-2025-12126 is an insecure direct object reference vulnerability in the Total Book Project WordPress plugin by ryanmoyer. The issue arises from insufficient validation of a user-controlled key parameter in multiple functions, allowing authenticated users with Contributor-level privileges or above to perform unauthorized actions on book chapters belonging to other users. This bypasses intended authorization controls and impacts data integrity and confidentiality within the plugin's scope.

An attacker with Contributor-level or higher access can manipulate book chapters they do not own by moving, deleting, or creating them. This compromises the integrity and confidentiality of content managed by the plugin. The vulnerability does not allow for denial of service or privilege escalation beyond the Contributor role. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and monitor for suspicious activity related to book chapter modifications. Avoid granting Contributor or higher privileges to untrusted users.