CVE-2026-1314: Data Access in 3D FlipBook WordPress Plugin

An attacker can exploit this vulnerability to retrieve sensitive information stored within flipbooks, even those intended to be private or password-protected. This could include confidential documents, internal reports, or other proprietary data. While the vulnerability doesn't grant direct access to the flipbook content itself, the metadata leakage can provide valuable insights into the structure and content of the flipbooks, potentially aiding in further attacks. The ability to access draft flipbooks could also reveal work-in-progress materials or sensitive information not yet intended for public consumption. The impact is amplified if the flipbooks contain personally identifiable information (PII) or other regulated data.

1. Veröffentlicht2026-04-15
2. EPSS aktualisiert2026-04-22

The primary mitigation is to immediately upgrade the 3D FlipBook plugin to version 1.16.18 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider restricting access to the plugin's administrative interface to authorized personnel only. Implement a Web Application Firewall (WAF) with rules to block suspicious requests targeting the sendpostpages_json() endpoint. Monitor server logs for unusual activity related to the plugin. After upgrading, confirm the fix by attempting to access flipbook metadata without authentication; successful access indicates the vulnerability persists.