CVE-2026-86842 Overview
CVE-2026-86842 affects the Real3D Flipbook WordPress plugin in versions before 5.4. The plugin fails to perform capability checks on several authenticated flipbook management actions. Users with Author-level access or above can delete other users' flipbook content and overwrite administrator-only global settings. Attackers can leverage the settings overwrite to store JavaScript that executes when any visitor or administrator views affected pages. The flaw is categorized as Missing Authorization [CWE-862].
Critical Impact
Author-level accounts can inject persistent JavaScript that runs in the browsers of administrators and site visitors, enabling session theft and account takeover.
Affected Products
- Real3D Flipbook WordPress plugin versions before 5.4
Discovery Timeline
- 2026-09-23 - CVE-2026-86842 published to the National Vulnerability Database
- 2026-09-23 - Last updated in NVD database
Technical Details for CVE-2026-86842
Vulnerability Analysis
The Real3D Flipbook plugin exposes multiple authenticated AJAX or admin actions for managing flipbooks and global plugin settings. These handlers verify that a request is authenticated but do not verify that the requesting user holds the required WordPress capability for the action. As a result, any account with edit_posts or higher, such as an Author, can invoke administrator-scoped operations.
Two distinct impacts follow from the missing checks. First, an Author can delete flipbook content owned by other users, causing integrity loss and denial of service for legitimate content. Second, the same account can overwrite global plugin settings that are intended to be restricted to administrators. Because those settings are rendered into pages served to site visitors, an attacker can insert JavaScript payloads that execute in every viewer's browser session.
The stored cross-site scripting condition escalates the impact beyond the plugin itself. Executing script in an administrator's browser allows the attacker to perform any action the administrator can perform, including creating new administrator accounts, installing plugins, or exfiltrating data.
Root Cause
The root cause is the absence of current_user_can() capability checks in the plugin's authenticated action handlers. WordPress requires developers to enforce both nonce verification and capability verification. This plugin relies on authentication alone, which is insufficient for privileged operations.
Attack Vector
Exploitation requires an authenticated account with Author privileges or higher and user interaction to trigger the payload rendering path. An attacker who acquires such an account, either through registration, credential compromise, or insider access, sends crafted requests to the vulnerable plugin endpoints to overwrite global settings with malicious JavaScript. Refer to the WPScan Vulnerability Report for technical details on the affected endpoints.
Detect Identity Attacks the Moment Authentication Fails
Singularity™ Identity surfaces credential misuse, lateral movement, and privilege escalation in real time, so you can contain the breach before it spreads.
Stop Identity AttacksDetection Methods for CVE-2026-86842
Indicators of Compromise
- Unexpected changes to Real3D Flipbook global settings performed by non-administrator accounts.
- Presence of <script> tags or JavaScript event handlers stored in flipbook configuration fields.
- Deletion of flipbook posts or attachments by users other than their original authors.
- Creation of new administrator accounts shortly after Author-level activity involving the plugin.
Detection Strategies
- Audit WordPress database tables for Real3D Flipbook option values containing script tags, javascript: URIs, or event handler attributes.
- Review web server access logs for POST requests from Author-level users to plugin AJAX endpoints handling settings or deletion actions.
- Correlate plugin setting modifications with the acting user role in WordPress audit logs.
Monitoring Recommendations
- Enable a WordPress activity logging plugin to record option changes and content deletions with user attribution.
- Alert on any modification to plugin global settings by users lacking the manage_options capability.
- Monitor administrator sessions for anomalous actions such as unexpected user creation or plugin installation.
How to Mitigate CVE-2026-86842
Immediate Actions Required
- Update the Real3D Flipbook plugin to version 5.4 or later on all WordPress instances.
- Review flipbook global settings for injected JavaScript and remove any unauthorized content.
- Audit user accounts with Author role or higher and revoke access for accounts that are no longer required.
- Rotate administrator credentials and invalidate active sessions if injection is suspected.
Patch Information
The vendor addressed the missing authorization checks in Real3D Flipbook version 5.4. Administrators should apply the update through the WordPress plugin dashboard or by manually replacing the plugin files. Details are available in the WPScan Vulnerability Report.
Workarounds
- Deactivate the Real3D Flipbook plugin until the update to version 5.4 can be applied.
- Restrict Author and Contributor account creation and disable open user registration.
- Deploy a web application firewall rule that blocks requests to the plugin's settings endpoints from non-administrator sessions.
# Configuration example
wp plugin update real3d-flipbook --version=5.4
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
