CVE-2026-15758: 3D FlipBook WordPress Information Disclosure

CVE-2026-15758 Overview

CVE-2026-15758 is a sensitive information exposure vulnerability in the 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress. The flaw affects all versions up to and including 1.16.20. Unauthenticated attackers can query the plugin's AJAX endpoint using the id parameter to retrieve the full metadata payload of password-protected flipbooks. Exposed data includes the flipbook title, outline, props, and the serialized data blob that contains the underlying PDF file's direct URL. This bypasses the WordPress post-password confidentiality model. Attackers do not need prior knowledge of flipbook IDs because the also-unauthenticated fb3d_send_posts AJAX action enumerates them. The issue is tracked under [CWE-200].

Critical Impact
Unauthenticated attackers can enumerate and read the contents of password-protected flipbooks, including direct URLs to protected PDF files, defeating the intended access control.

Affected Products

3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress
All versions up to and including 1.16.20
WordPress sites exposing the fb3d_send_posts and related ajax-get.php endpoints

Discovery Timeline

2026-09-15 - CVE-2026-15758 published to NVD
2026-09-17 - Last updated in NVD database

Technical Details for CVE-2026-15758

Vulnerability Analysis

The vulnerability resides in the plugin's AJAX handler defined in inc/ajax-get.php. The handler accepts an id parameter identifying a flipbook post and returns the post's metadata payload without verifying whether the requester has satisfied the WordPress post-password check. As a result, the confidentiality control that WordPress applies to password-protected posts is bypassed at the API layer. The returned payload includes the flipbook title, outline structure, rendering props, and the serialized data blob containing a direct URL to the underlying PDF file. Because the direct URL points at the uploaded asset in wp-content, an attacker can request the PDF outside of the flipbook viewer and read its contents entirely.

Root Cause

The root cause is a missing authorization and password-gate check in the AJAX response path. The endpoint treats the presence of a valid post id as sufficient to release metadata, ignoring the post_password state on the target post. This is a classic [CWE-200] information exposure defect where server-side logic omits the required confidentiality check before returning sensitive fields.

Attack Vector

Exploitation is remote, unauthenticated, and requires no user interaction. An attacker first invokes the fb3d_send_posts AJAX action to enumerate every flipbook post ID on the target site. The attacker then issues a follow-up AJAX request for each ID against the vulnerable handler in ajax-get.php. The server returns the full metadata payload, including the direct PDF URL, which the attacker downloads directly over HTTP. No cookies, nonces, or authenticated sessions are required.

For code-level context, see the WordPress plugin source lines referenced in the WordPress Plugin Code Reference Line 119, Line 136, and Line 142, along with the Wordfence Vulnerability Analysis.

Detection Methods for CVE-2026-15758

Indicators of Compromise

Unauthenticated POST or GET requests to admin-ajax.php with action=fb3d_send_posts from external IP addresses.
Sequential or scripted requests to the plugin's ajax-get.php handler enumerating multiple id parameter values in a short interval.
Direct HTTP fetches to PDF files under wp-content/uploads/ that were previously reachable only through password-protected flipbook posts.

Detection Strategies

Inspect web server access logs for admin-ajax.php calls carrying the fb3d_send_posts action or references to the ajax-get.php handler from unauthenticated sessions.
Correlate flipbook metadata requests with subsequent direct PDF downloads by the same client IP to identify successful exploitation chains.
Deploy WAF rules that flag high-volume access to plugin AJAX endpoints from a single source.

Monitoring Recommendations

Enable verbose HTTP logging on WordPress endpoints and forward events to a centralized analytics platform for anomaly detection.
Baseline normal request volume for the 3D FlipBook plugin's AJAX actions and alert on deviations.
Monitor for referrer-less requests to PDF assets that belong to password-protected posts.

How to Mitigate CVE-2026-15758

Immediate Actions Required

Update the 3D FlipBook plugin to the version above 1.16.20 that contains the referenced fix.
Audit password-protected flipbooks and rotate any content that must remain confidential, treating exposed PDFs as disclosed.
Restrict access to admin-ajax.php calls for the fb3d_send_posts action at the WAF or reverse proxy layer until patching is complete.

Patch Information

The vendor addressed the flaw in the plugin repository. Review the fix in the WordPress Plugin Changeset Review and confirm the deployed version is later than 1.16.20.

Workarounds

Deactivate the 3D FlipBook plugin on sites that host confidential PDFs until the patched release is applied.
Block unauthenticated requests to the fb3d_send_posts action and the plugin's ajax-get.php handler via WAF rules.
Move sensitive PDF assets out of publicly accessible wp-content/uploads/ paths and serve them through an authenticated download handler.

bash

# Example nginx rule to block unauthenticated access to the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($arg_action = "fb3d_send_posts") { return 403; }
}