CVE-2026-74007: 3D FlipBook Data Exposure Vulnerability

CVE-2026-74007 Overview

CVE-2026-74007 is a sensitive data exposure vulnerability in the 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin. The flaw affects all versions up to and including 1.16.20. Unauthenticated attackers can access sensitive information over the network without user interaction. The issue is classified under [CWE-497] (Exposure of Sensitive System Information to an Unauthorized Control Sphere).

Critical Impact
Unauthenticated network attackers can retrieve sensitive data from vulnerable WordPress sites running the 3D FlipBook plugin at versions 1.16.20 or earlier.

Affected Products

3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin versions <= 1.16.20
WordPress sites with the interactive-3d-flipbook-powered-physics-engine plugin installed
All WordPress deployments serving PDF or image gallery content via this plugin

Discovery Timeline

2026-08-18 - CVE-2026-74007 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74007

Vulnerability Analysis

The 3D FlipBook plugin exposes sensitive information to unauthenticated requests. An attacker sends a network request to a vulnerable endpoint and receives data that should be restricted to authenticated or privileged users. The attack requires no authentication, no user interaction, and low complexity to execute.

The vulnerability affects confidentiality only. Integrity and availability of the target system remain intact. The scope of exposed information depends on plugin configuration and server context, but the flaw provides attackers with reconnaissance data useful for follow-on attacks against the WordPress installation.

Root Cause

The root cause is improper access control on plugin endpoints that return sensitive data [CWE-497]. The plugin does not enforce authentication or authorization checks before returning information that should be protected. Any remote client can invoke the affected functionality and read the exposed content.

Attack Vector

Exploitation occurs over the network against the WordPress site hosting the vulnerable plugin. The attacker issues crafted HTTP requests to plugin endpoints exposed by the interactive-3d-flipbook-powered-physics-engine component. No credentials, session tokens, or interactive steps are required. See the Patchstack WordPress Vulnerability Report for endpoint-level technical details.

Detection Methods for CVE-2026-74007

Indicators of Compromise

Anomalous unauthenticated HTTP GET requests targeting /wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/ paths
Repeated access to plugin AJAX or REST endpoints from a single source IP without prior authentication
Web server logs showing responses containing configuration data or file listings returned to anonymous clients

Detection Strategies

Inspect WordPress access logs for high-volume requests to 3D FlipBook plugin endpoints from unauthenticated sessions
Deploy web application firewall (WAF) rules that flag requests to the plugin path returning response bodies larger than expected for static assets
Correlate plugin endpoint access with subsequent authentication attempts or credential-related activity on the same site

Monitoring Recommendations

Enable verbose logging on the WordPress reverse proxy or WAF for the affected plugin directory
Track EPSS scoring changes for CVE-2026-74007; current EPSS is 0.24% but may rise if public exploitation emerges
Alert on outbound reconnaissance patterns following plugin endpoint access, indicating attacker follow-on activity

How to Mitigate CVE-2026-74007

Immediate Actions Required

Identify all WordPress sites running the 3D FlipBook – PDF Flipbook Viewer plugin and confirm the installed version
Update the plugin to a version later than 1.16.20 as soon as the vendor publishes a patched release
Restrict access to WordPress plugin directories through WAF or reverse-proxy rules until a fix is applied

Patch Information

At the time of publication, review the Patchstack advisory for CVE-2026-74007 for the latest fixed version information. Apply the vendor-supplied patch through the WordPress plugin manager or WP-CLI once available.

Workarounds

Disable and remove the 3D FlipBook plugin on any WordPress site where a patched version is not yet available
Block unauthenticated requests to plugin endpoints at the WAF or reverse proxy until remediation is complete
Restrict plugin functionality to authenticated users only via .htaccess or equivalent web server access rules

bash

# Configuration example: block unauthenticated access to the plugin path at the web server layer
# Apache .htaccess snippet
<LocationMatch "/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/">
    Require valid-user
</LocationMatch>

# Or, with WP-CLI, deactivate the plugin site-wide until patched
wp plugin deactivate interactive-3d-flipbook-powered-physics-engine --all