CVE-2026-1314: WordPress 3D FlipBook Info Disclosure Flaw

CVE-2026-1314 Overview

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress contains a missing authorization vulnerability in the send_post_pages_json() function. This security flaw affects all versions up to and including 1.16.17, allowing unauthenticated attackers to bypass access controls and retrieve sensitive flipbook page metadata for content that should be restricted—including draft, private, and password-protected flipbooks.

Critical Impact

Unauthenticated attackers can access metadata from private, draft, and password-protected flipbook content without any authentication, potentially exposing sensitive organizational information.

Affected Products

• 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress versions ≤ 1.16.17
• WordPress installations with the vulnerable plugin versions installed
• Sites utilizing private or password-protected flipbook content

Discovery Timeline

• 2026-04-15 - CVE CVE-2026-1314 published to NVD
• 2026-04-15 - Last updated in NVD database

Technical Details for CVE-2026-1314

Vulnerability Analysis

This vulnerability falls under CWE-862 (Missing Authorization), a common security weakness where an application fails to verify that a user has the necessary privileges before allowing access to protected resources. The send_post_pages_json() function in the 3D FlipBook plugin processes requests for flipbook page metadata without implementing any capability checks or authentication verification.

In WordPress plugin development, functions that expose sensitive data should implement capability checks using functions like current_user_can() to verify the requesting user has appropriate permissions. The absence of this check creates a direct path for unauthorized data access.

Root Cause

The root cause of this vulnerability is the complete absence of a capability check within the send_post_pages_json() function. WordPress provides a robust permission system that allows developers to restrict functionality based on user roles and capabilities. When a plugin function fails to implement these checks, any user—including unauthenticated visitors—can invoke the function and access the data it returns.

The function appears to be accessible via WordPress AJAX or REST endpoints without requiring authentication, directly returning flipbook metadata regardless of the post status (draft, private, or password-protected).

Attack Vector

The attack vector is network-based and requires no authentication, privileges, or user interaction. An attacker can exploit this vulnerability by sending crafted requests to the WordPress site targeting the vulnerable send_post_pages_json() function.

The exploitation process involves:

1. Identifying WordPress sites running the vulnerable 3D FlipBook plugin versions (≤ 1.16.17)
2. Crafting HTTP requests that invoke the send_post_pages_json() function
3. Enumerating flipbook post IDs to retrieve metadata for private, draft, or password-protected content
4. Extracting sensitive information from the returned JSON responses

For detailed technical information regarding the vulnerability mechanism, refer to the Wordfence Vulnerability Report.

Detection Methods for CVE-2026-1314

Indicators of Compromise

• Unusual HTTP requests targeting flipbook-related AJAX endpoints without authenticated sessions
• High volume of requests attempting to enumerate post IDs through the send_post_pages_json() function
• Access log entries showing successful JSON responses for private or draft post content from unauthenticated sources
• Suspicious patterns of requests probing for flipbook metadata across multiple post IDs

Detection Strategies

• Monitor web server access logs for requests containing send_post_pages_json or related flipbook AJAX actions from unauthenticated users
• Implement Web Application Firewall (WAF) rules to detect and alert on enumeration attempts targeting flipbook endpoints
• Review WordPress audit logs for unauthorized access attempts to protected flipbook content
• Deploy SentinelOne Singularity Platform for real-time endpoint monitoring and behavioral analysis of WordPress application traffic

Monitoring Recommendations

• Enable detailed logging for WordPress AJAX requests, particularly those related to the 3D FlipBook plugin
• Configure alerting for anomalous request patterns targeting plugin endpoints from external IP addresses
• Implement rate limiting on AJAX endpoints to slow down enumeration attacks
• Use SentinelOne's application control features to monitor file access patterns on WordPress installations

How to Mitigate CVE-2026-1314

Immediate Actions Required

• Update the 3D FlipBook plugin to a version newer than 1.16.17 immediately
• Audit WordPress sites for installations of the vulnerable plugin versions
• Review access logs to determine if the vulnerability has been exploited
• Temporarily disable the 3D FlipBook plugin if an update is not immediately available

Patch Information

A security patch addressing this vulnerability is available. The fix introduces proper capability checks to the send_post_pages_json() function, ensuring that only authorized users can access flipbook metadata for protected content. The patch details can be reviewed in the WordPress Change Log Entry.

Site administrators should update to the latest version of the 3D FlipBook plugin through the WordPress dashboard or by downloading directly from the WordPress plugin repository.

Workarounds

• Implement Web Application Firewall (WAF) rules to block unauthenticated requests to flipbook AJAX endpoints
• Use WordPress security plugins to add additional access control layers to sensitive plugin functions
• Restrict access to the WordPress admin-ajax.php endpoint from untrusted IP ranges if feasible
• Review and remove any sensitive content from flipbooks until the plugin is updated

# Example: Blocking unauthenticated access to flipbook endpoints via .htaccess
# Add to WordPress root .htaccess file

<IfModule mod_rewrite.c>
RewriteEngine On
# Block unauthenticated requests to specific flipbook actions
RewriteCond %{REQUEST_URI} ^/wp-admin/admin-ajax\.php [NC]
RewriteCond %{QUERY_STRING} action=.*flipbook.* [NC]
RewriteCond %{HTTP_COOKIE} !wordpress_logged_in [NC]
RewriteRule .* - [F,L]
</IfModule>