The vulnerability is an insecure direct object reference in all versions up to and including 1.0 of the Total Book Project plugin for WordPress. The absence of validation on a user‑controlled key allows an authenticated user with Contributor or higher privileges to move, delete, or create chapters for books that do not belong to them. This directly compromises the integrity of those books, allowing attackers to alter, destroy, or inject content outside of their own scope. The weakness aligns with CWE‑639.

This flaw affects the WordPress plugin The Total Book Project authored by Ryan Moyer, in all released versions through 1.0. Users running any version of the plugin on a WordPress installation are potentially vulnerable until the license is updated to a version beyond 1.0.

The CVSS base score is 5.4, indicating moderate risk. The EPSS score is below 1%, suggesting a low exploitation probability but not zero. The vulnerability is not listed in the CISA KEV catalog, which implies it has not yet been exploited in the wild at the time of this analysis. Successful exploitation requires an authenticated account with Contributor level or higher and likely involves interacting with the plugin’s administrative interfaces to craft requests that reference the protected book objects.