CVE-2026-86842: Real3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with Author-level access or higher can access the affected flipbook management actions. This includes users who would not normally be permitted to alter global plugin settings or other users' flipbook content.
What capabilities does exploitation provide?
An attacker can delete flipbook content belonging to other users and overwrite administrator-only global settings. By placing JavaScript in those settings, they can cause stored script execution when a visitor or administrator views the site.
Is authentication required for exploitation?
Yes. The affected actions require an authenticated WordPress account with at least the Author role; the provided information does not indicate unauthenticated exploitation.
How can an administrator identify potential exposure?
Check whether Real3D Flipbook Lite is installed at a version earlier than 5.4 and whether Author or higher accounts have access to the site. Review flipbook content and global plugin settings for unauthorized changes or unexpected JavaScript.