CVE-2026-1314
Received Received - Intake
Unauthorized Data Access in 3D FlipBook WordPress Plugin

Publication date: 2026-04-15

Last updated on: 2026-04-15

Assigner: Wordfence

Description
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-15
Last Modified
2026-04-15
Generated
2026-06-16
AI Q&A
2026-04-15
EPSS Evaluated
2026-06-15
NVD
CVE-2026-1314
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wp-flipbook 3d_flipbook to 1.16.17 (inc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Compliance Impact

The vulnerability allows unauthenticated attackers to access flipbook page metadata for draft, private, and password-protected flipbooks due to a missing capability check.

This unauthorized access to potentially sensitive or private data could lead to non-compliance with data protection regulations such as GDPR or HIPAA, which require proper access controls to protect personal or sensitive information.

Executive Summary

The vulnerability exists in the 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress. It is caused by a missing capability check in the send_post_pages_json() function in all versions up to and including 1.16.17.

Because of this missing check, unauthenticated attackers can access and retrieve flipbook page metadata even for draft, private, and password-protected flipbooks.

Impact Analysis

This vulnerability allows unauthorized users to access sensitive metadata related to flipbook pages without authentication.

While it does not allow modification or deletion of data, the exposure of metadata from draft, private, and password-protected flipbooks could lead to information disclosure.

The CVSS base score of 5.3 indicates a medium severity impact, primarily affecting confidentiality.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-1314. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart