Security Alert Summary
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress contains a missing capability check in the send_post_pages_json() function. This allows unauthenticated attackers to retrieve flipbook page metadata for draft, private, and password-protected flipbooks, potentially exposing limited confidential information about those flipbooks.
CVE Details
- CVE ID: CVE-2026-1314
- Affected component: 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress
- Affected versions: All versions up to, and including, 1.16.17
- Published: April 15, 2026 at 04:17:32 AM UTC
- Last modified: April 15, 2026 at 04:17:32 AM UTC
- CVSS v3.1: Base Score 5.3 – MEDIUM
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Attack Vector: NETWORK
- Attack Complexity: LOW
- Privileges Required: NONE
- User Interaction: NONE
- Scope: UNCHANGED
- Authentication required: No
- Primary impact:
- Confidentiality: LOW
- Integrity: NONE
- Availability: NONE
- Weakness (CWE): CWE-862
Technical Details
The plugin fails to perform a capability check in the send_post_pages_json() function. Because that check is missing, unauthenticated requests can access the endpoint or code path that returns flipbook page metadata. The metadata returned can include information about pages for flipbooks that are draft, private, or protected by a password. The issue exists due to an authorization control omission rather than a flaw in encryption or data storage.
Named function involved: send_post_pages_json(). The core weakness is a missing capability/authorization check on the server side that would normally restrict access to authenticated users with appropriate privileges.
How This Could Impact Your Website
On a typical site, multiple users may interact with flipbooks: a site owner or administrator publishes content, internal staff create draft flipbooks, and external contractors or contributors may upload or prepare materials. If metadata for draft, private, or password-protected flipbooks is exposed, this can reveal document titles, page captions, or other descriptive data that was intended to remain restricted.
- Exposure of descriptive metadata could increase the risk of targeted phishing or social engineering against staff or contributors.
- Information about unpublished or internal documents could reveal business activities, project names, or publication schedules that attackers could use for reconnaissance.
- Although the integrity and availability of the site are not indicated as impacted by this vulnerability, the confidentiality impact is rated low and should be taken seriously for sensitive content.
If youre unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially for contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual access patterns or requests targeting plugin endpoints.
If youd like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
