The Post Type Switcher plugin for WordPress contains an insecure direct object reference that lets authenticated users with Author role or higher alter the post type of any post or page they don’t own. The flaw permits the attacker to reclassify arbitrary content, which can break navigation, cause site disruption, and harm SEO. This weakness aligns with CWE‑639, a lack of fine‑grained authorization.

WordPress installations running the Post Type Switcher plugin version 4.0.0 or earlier are affected. Administrators who have deployed these versions should review the plugin’s version and consider updating or disabling it.

With a CVSS score of 5.4 the vulnerability is moderately severe. The EPSS score of less than 1% indicates a very low probability that attackers are already exploiting it, and it is not listed in CISA’s KEV catalog. Likely exploitation requires the attacker to be a logged‑in user with Author or higher privileges and to know the identifier of the target post or page. Because no remote code execution or privilege escalation is involved, the impact is limited to content modification and associated site disruption.