CVE-2026-15758: 3D FlipBook <= 1.16.20 - Unauthenticated Sensitive Information Exposure in 'id' Parameter
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.16.20 via the 'id' parameter. This makes it possible for unauthenticated attackers to extract sensitive data including the full metadata payload of password-protected flipbooks — including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL — bypassing WordPress post-password confidentiality. Flipbook post IDs can be pre-enumerated via the also-unauthenticated fb3dsendposts AJAX action, requiring no prior knowledge to target specific flipbooks.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress plugin 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Galleryto a version that resolves this vulnerability.Fixed in 1.16.20 - Compensating control
Restrict access to the WordPress AJAX endpoint 'fb3d_send_posts' (e.g., via network controls/WAF/ACL) to prevent unauthenticated attackers from pre-enumerating flipbook post IDs and targeting flipbooks via the 'id' parameter.
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker can exploit it. They do not need a WordPress account, prior knowledge of a flipbook post ID, or the password for a protected flipbook.
How can an attacker identify flipbooks to target?
The unauthenticated fb3d_send_posts AJAX action can be used to pre-enumerate flipbook post IDs. Those IDs can then be supplied through the affected id parameter.
What information may be exposed?
An attacker can retrieve the full metadata payload for password-protected flipbooks, including the title, outline, props, and serialized data containing the direct URL of the underlying PDF file. This bypasses WordPress post-password confidentiality.
Which plugin versions are affected?
All versions of the plugin through and including 1.16.20 are affected.