CVE-2026-49047: DearFlip Authorization Bypass Vulnerability

CVE-2026-49047 Overview

CVE-2026-49047 is a Missing Authorization vulnerability [CWE-862] in the DearHive DearFlip WordPress plugin, also known as 3D FlipBook DFlip Lite. The issue affects all versions up to and including 2.4.27. The plugin enforces incorrectly configured access control security levels, allowing authenticated users with low privileges to access functionality that should be restricted.

The vulnerability requires network-based access and low-level authentication, with no user interaction required. Exploitation can lead to limited disclosure of information handled by the plugin. The flaw does not affect data integrity or availability.

Critical Impact
Authenticated low-privilege users can bypass access control checks in DearFlip 2.4.27 and earlier, exposing plugin functionality intended for higher-privileged roles.

Affected Products

DearHive DearFlip (3D FlipBook DFlip Lite) WordPress plugin
All versions from n/a through 2.4.27
WordPress installations using the DearFlip plugin

Discovery Timeline

2026-05-27 - CVE-2026-49047 published to NVD
2026-05-27 - Last updated in NVD database

Technical Details for CVE-2026-49047

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the DearFlip WordPress plugin. The plugin exposes one or more action handlers without verifying that the requesting user holds the correct capability or role. WordPress plugins commonly route privileged actions through admin-ajax.php or REST endpoints, and each handler must independently validate user capabilities using functions such as current_user_can().

In DearFlip versions through 2.4.27, this validation is incorrectly configured. A user authenticated as a Subscriber, Contributor, or other low-privilege role can invoke plugin actions that should be limited to Editors or Administrators. The result is a confidentiality impact on data managed by the plugin.

The weakness aligns with CWE-862: Missing Authorization, where the software does not perform an authorization check when an actor attempts to access a resource or perform an action.

Root Cause

The root cause is the absence of capability verification on plugin action handlers. The plugin relies on authentication alone as a security boundary, rather than enforcing role-based access controls on individual operations. Any authenticated session is treated as sufficient permission to invoke the affected endpoints.

Attack Vector

The attack vector is network-based. An attacker must first obtain a valid WordPress account at any privilege tier, which is often trivial on sites that allow open registration. The attacker then sends crafted HTTP requests to the DearFlip plugin endpoints exposed within the WordPress installation. Because no user interaction is required and complexity is low, exploitation is straightforward once a session exists.

No verified proof-of-concept code is publicly available. See the Patchstack WordPress Vulnerability advisory for additional technical context.

Detection Methods for CVE-2026-49047

Indicators of Compromise

Unexpected HTTP POST requests to wp-admin/admin-ajax.php with action parameters referencing DearFlip handlers from low-privilege user sessions.
Access to DearFlip configuration, PDF assets, or flipbook records by accounts that should not have such permissions.
WordPress audit log entries showing Subscriber or Contributor accounts performing plugin operations normally reserved for Editors or Administrators.

Detection Strategies

Review WordPress access logs for requests targeting DearFlip endpoints originating from non-administrative user IDs.
Correlate authenticated session activity with plugin actions to identify role-action mismatches.
Deploy a Web Application Firewall (WAF) ruleset that flags requests to known DearFlip action handlers when the originating user lacks administrative cookies.

Monitoring Recommendations

Enable verbose logging on admin-ajax.php and WordPress REST API routes used by the plugin.
Monitor newly registered accounts that immediately interact with plugin-specific endpoints.
Alert on bulk or repeated calls to DearFlip handlers from a single authenticated session.

How to Mitigate CVE-2026-49047

Immediate Actions Required

Upgrade DearFlip to a version newer than 2.4.27 once the vendor publishes a fixed release.
Audit existing WordPress user accounts and remove untrusted low-privilege users while the patch is pending.
Disable open user registration on sites that do not require it to reduce the attacker pool.

Patch Information

The vendor advisory is tracked through the Patchstack database entry for the DearFlip plugin. Site administrators should monitor the plugin's official WordPress.org listing and update to the first release that supersedes 2.4.27 with a documented fix for broken access control.

Workarounds

Temporarily deactivate the DearFlip plugin on production sites until a patched version is installed.
Restrict access to wp-admin/admin-ajax.php and REST endpoints using WAF rules that require administrative authentication for DearFlip actions.
Apply the principle of least privilege by reviewing and reducing capabilities assigned to default roles.

bash

# Configuration example: block DearFlip AJAX actions for unauthenticated and low-priv users via .htaccess WAF snippet
<IfModule mod_rewrite.c>
  RewriteEngine On
  RewriteCond %{QUERY_STRING} action=(dflip|dearflip) [NC]
  RewriteCond %{HTTP_COOKIE} !wordpress_logged_in_admin [NC]
  RewriteRule ^wp-admin/admin-ajax\.php$ - [F,L]
</IfModule>