Description

The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-23T06:17:04.343Z",
  "pubdate": "2026-09-23T06:17:04.343Z",
  "executiveSummary": "The Real3D Flipbook WordPress plugin prior to version 5.4 contains a critical authorization flaw that allows authenticated users with Author-level privileges to perform unauthorized administrative actions. This vulnerability stems from a failure to implement proper capability checks on sensitive backend management endpoints. By exploiting this oversight, an attacker can manipulate, delete, or overwrite flipbook content and modify global plugin settings that are strictly intended for administrative personnel. The risk is significantly amplified by the potential for stored Cross-Site Scripting (XSS), as the ability to modify global settings allows an attacker to inject malicious JavaScript payloads. These scripts execute within the session context of any administrator or visitor accessing the site, potentially leading to full site compromise, administrative account takeover, or the distribution of malicious content to unsuspecting users. Given that the vulnerability requires only low-level authentication (Author role), the attack surface is substantial for any WordPress site utilizing this plugin.",
  "technicalDetails": "The vulnerability resides within the authentication and authorization handling logic of the Real3D Flipbook plugin. The core issue is an 'Insecure Direct Object Reference' (IDOR) or more broadly, an 'Improper Access Control' flaw where the plugin assumes that the presence of an authenticated session is sufficient to authorize actions on flipbook management endpoints. Specifically, the plugin fails to validate the user's capability context (e.g., 'manage_options' or specific plugin capabilities) against the requested action.\nThe attack flow begins when an attacker, authenticated as a user with at least Author-level privileges, sends specially crafted HTTP requests to the plugin’s backend management functions. Because the code lacks programmatic checks such as current_user_can(), the application proceeds to execute the requested business logic without verifying that the user possesses the requisite administrative rights.\nThe exploitation of global settings modification is particularly severe. By overwriting plugin configuration parameters, an attacker can inject arbitrary malicious JavaScript. When an administrator or visitor loads a page utilizing the Real3D Flipbook plugin, the injected code is rendered by the browser. This allows for session hijacking through document.cookie theft, unauthorized modification of site content, or forced redirections to malicious domains.\nFurthermore, the lack of capability checks extends to flipbook content management. An attacker can systematically delete or overwrite any flipbook assets belonging to other users or the administrator. This destructive capability allows for unauthorized data destruction or the replacement of legitimate content with malicious or defaced assets.\nThe vulnerability affects all versions of the Real3D Flipbook plugin prior to 5.4. It is accessible via standard WordPress authenticated session tokens. No advanced network access is required, as the vulnerability is triggered through the standard administrative interface or AJAX endpoints reachable by any logged-in user with Author privileges. The lack of input validation or effective sanitization on global configuration fields exacerbates the Stored XSS impact, ensuring that the payload remains persistent across the site's database until manually removed or the plugin is patched."
}