CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.
Explanation of Vulnerability in Simple Terms
The 3D FlipBook plugin for WordPress fails to properly check user permissions before allowing access to sensitive data. An attacker without authentication can read information they should not have access to. The vulnerability affects all versions up to 1.16.17. Site administrators should update to a version newer than 1.16.17 as soon as it becomes available.
What an attacker can do
Read sensitive data without logging in or having permission to access it.
Potential impact on your site
Unauthorized visitors can access private or restricted content stored in your flipbook galleries.
Conditions required to exploit
Network access only; no authentication or user interaction required.
Key dates
External resources
Related vulnerabilities
