WordPress Plugin Vulnerabilities
3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery < 1.16.18 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
Description
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.
Affects Plugins
Fixed in 1.16.18 References
Classification
Type
NO AUTHORISATION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Kai Aizen
Verified
No
WPVDB ID
Timeline
Publicly Published
2026-04-14 (about 29 days ago)
Added
2026-04-14 (about 29 days ago)
Last Updated
2026-04-14 (about 28 days ago)
WPScan 