Description

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-15T06:16:54.020Z",
  "pubdate": "2026-09-15T06:16:54.020Z",
  "executiveSummary": "The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is susceptible to an unauthenticated sensitive information exposure vulnerability. The issue stems from insufficient access controls within the plugin's data retrieval mechanisms, allowing remote attackers to bypass WordPress post-password protection features. By leveraging publicly accessible AJAX actions, an attacker can enumerate flipbook post IDs and subsequently extract sensitive metadata and file references for restricted content. This vulnerability poses a significant risk to data confidentiality, as it facilitates unauthorized access to private document structures, including direct URLs to protected PDF assets, regardless of the intended password restrictions set by site administrators. No prior authentication or elevated privileges are required for successful exploitation, making this a high-impact risk for WordPress installations utilizing this plugin.",
  "technicalDetails": "The vulnerability resides in the insecure implementation of data-fetching routines within the 3D FlipBook plugin, specifically affecting versions 1.16.20 and prior. The root cause involves a failure to perform server-side verification of a user's authorization status (or password verification context) when processing requests for flipbook data.\nThe attack flow begins with the exploitation of the unauthenticated 'fb3d_send_posts' AJAX action. This endpoint is designed to return a collection of flipbook post IDs. Because this action does not enforce access controls, an unauthenticated attacker can programmatically enumerate existing post IDs across the WordPress installation to identify targets of interest.\nOnce an attacker has identified a target post ID, they can invoke the vulnerable 'id' parameter in subsequent requests. The plugin fails to validate whether the current user possesses the necessary credentials to view content protected by WordPress password features. Instead, the backend processes the request and returns the full metadata payload associated with the flipbook. This payload includes sensitive objects such as the document title, structural outlines, custom properties, and a serialized data blob. Crucially, this blob often contains the direct URL to the underlying PDF file.\nBy extracting the direct URL from the serialized data, an attacker effectively bypasses the WordPress authentication layer entirely, gaining direct access to the hosted PDF files that were intended to be protected by password confidentiality. This sequence represents a complete breakdown of the intended access control model for flipbook content, allowing attackers to exfiltrate private document assets with minimal effort or complexity. The lack of input validation and the absence of session-based access checks within the plugin's request handling logic constitute the primary failure in the product's security architecture."
}