CVE-2025-24776: Responsive Flipbooks Auth Bypass Vulnerability

CVE-2025-24776 Overview

CVE-2025-24776 is a missing authorization vulnerability in the Codelobster Responsive Flipbooks plugin for WordPress. The flaw affects all versions up to and including 1.0. Attackers with low-privileged authenticated access can exploit incorrectly configured access control security levels to perform actions beyond their intended permissions.

The issue is classified under [CWE-862: Missing Authorization]. It allows authenticated users to bypass authorization checks on plugin functionality, resulting in limited integrity and availability impact on affected WordPress sites.

Critical Impact
Authenticated attackers can invoke plugin actions without proper authorization checks, enabling unauthorized modification of flipbook content and configuration on affected WordPress sites.

Affected Products

Codelobster Responsive Flipbooks WordPress plugin
All versions from n/a through <= 1.0
WordPress sites with the responsive-flipbooks plugin installed and active

Discovery Timeline

2025-06-06 - CVE-2025-24776 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24776

Vulnerability Analysis

The Responsive Flipbooks plugin exposes functionality without enforcing appropriate capability or role checks. WordPress plugins typically register AJAX handlers or admin actions that must verify user capabilities using current_user_can() and validate nonces. The plugin fails to enforce these checks correctly on one or more endpoints.

An authenticated attacker with a low-privileged account, such as a Subscriber, can invoke restricted plugin functionality. This constitutes broken access control at the security level, allowing role boundaries to be crossed within the plugin's feature set.

The vulnerability requires network access and low privileges. No user interaction is needed, and the attack complexity is low. Impact is limited to integrity and availability of plugin-managed content, with no direct confidentiality loss.

Root Cause

The root cause is missing or insufficient authorization enforcement on plugin request handlers. The plugin does not correctly gate sensitive actions behind capability checks aligned with WordPress role definitions. Any authenticated session can therefore reach code paths intended only for administrators or editors.

Attack Vector

An attacker first obtains any valid WordPress account on a target site. This can be achieved on sites allowing open registration or through credential compromise. The attacker then issues HTTP requests to the unprotected plugin endpoints, invoking flipbook management or configuration actions. See the Patchstack Vulnerability Advisory for technical details on the affected endpoints.

No public proof-of-concept exploit or exploit database entry is currently associated with this CVE.

Detection Methods for CVE-2025-24776

Indicators of Compromise

Unexpected creation, modification, or deletion of flipbook entries in the WordPress database
HTTP POST requests to responsive-flipbooks plugin endpoints originating from low-privileged user sessions
New or altered plugin content associated with Subscriber or Contributor accounts

Detection Strategies

Review WordPress access logs for requests to admin-ajax.php or plugin URLs referencing responsive-flipbooks from non-administrative users
Audit user activity logs for role-inappropriate actions using a WordPress security plugin
Correlate authentication events with plugin state changes to identify unauthorized modifications

Monitoring Recommendations

Enable verbose WordPress audit logging and forward events to a centralized SIEM
Alert on flipbook configuration changes originating from accounts below the Editor role
Monitor for spikes in authenticated requests to plugin endpoints following new user registrations

How to Mitigate CVE-2025-24776

Immediate Actions Required

Deactivate and remove the Responsive Flipbooks plugin until a patched release becomes available
Restrict new user registrations or require administrator approval for account creation
Review existing user accounts and remove any unrecognized low-privileged users
Rotate credentials for any accounts that may have been used to exploit the vulnerability

Patch Information

No patched version has been published at the time of this advisory. The vulnerability affects all versions through 1.0, and no fixed release is listed in the Patchstack advisory. Site owners should monitor the plugin repository for updates from Codelobster.

Workarounds

Uninstall the Responsive Flipbooks plugin and use an alternative flipbook solution
Deploy a Web Application Firewall (WAF) rule to block requests to plugin endpoints from non-administrator sessions
Enforce least-privilege user roles and disable self-registration on public WordPress sites

bash

# Disable open user registration in wp-config.php or via wp-cli
wp option update users_can_register 0

# Deactivate and delete the vulnerable plugin
wp plugin deactivate responsive-flipbooks
wp plugin delete responsive-flipbooks