Log in Start free

Vulnerability · Published Sep 15, 2026 · Assigned by Wordfence

CVE-2026-157583D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter

Medium 5.3

In plain English

A medium-severity information exposure in 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery from iberezansky. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)0.5%top 59.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3d_send_posts AJAX action, requiring no prior knowledge to target specific flipbooks.

Affected products (as reported)

VendorProductVersions
iberezansky 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery 0 – through 1.16.20

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References