CVE-2025-12524 affects the Post Type Switcher plugin for WordPress, allowing authenticated users with Author-level privileges or above to exploit an insecure direct object reference vulnerability. This occurs because the plugin fails to properly validate a user-controlled key, enabling modification of the post type of arbitrary posts and pages, including those owned by administrators. The vulnerability can lead to site disruption and SEO issues. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required.

Exploitation allows authenticated users with Author-level access or higher to change the post type of any post or page, including those they do not own. This can disrupt site functionality, break navigation structures, and negatively affect search engine optimization. There is no indication of confidentiality impact, but integrity and availability impacts are present at a low to medium level.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Author-level access to trusted users only and monitor for unusual post type changes. Avoid granting elevated privileges unnecessarily. Follow updates from the plugin vendor for an official patch or temporary mitigation.