What is the CVSS score of EUVD-2026-49221?

EUVD-2026-49221 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

Which versions of 3D Flipbook PDF Viewer are affected by EUVD-2026-49221?

The WordPress plugin '3D Flipbook PDF Viewer & Embedder' (all versions up to and including 1.4.2) contains an unauthenticated server-side request forgery flaw that can let any remote attacker make an…

How to fix or mitigate EUVD-2026-49221?

Within 24 hours, inventory all WordPress installations for the '3D Flipbook PDF Viewer & Embedder' plugin and identify any version up to and including 1.4.2; if the plugin is not business-critical, deactivate and remove it immediately, and if it must remain active, restrict the WordPress host's outbound network access to required destinations, block access to link-local and cloud metadata addresses such as 169.254.169.254, and add WAF or reverse-proxy rules to block SSRF attempts against the plugin's PDF-fetch/embed endpoint. Within 7 days, enforce egress allowlisting and network segmentation for all WordPress servers, require IMDSv2 where cloud metadata services are used, enable logging and alerting on unexpected outbound requests from WordPress hosts, and evaluate a supported alternative to the plugin. Within 30 days, monitor the vendor for a fixed release and apply it as soon as it is available, or permanently remove the plugin if no supported patch is released; revalidate that all affected versions have been remediated, review cloud and internal service exposure from WordPress segments, and document compensating controls until remediation is complete.

3D Flipbook PDF Viewer EUVD-2026-49221

| CVE-2026-59552 HIGH

Server-Side Request Forgery (SSRF) (CWE-918)

2026-07-27 Patchstack

GHSA-xmhc-7qj6-cr9q

WordPress SSRF Wordpress Plugin 3D Flipbook Pdf Viewer Amp Embedder

7.2

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

7.2 HIGH

Unauthenticated remote SSRF (AV:N/AC:L/PR:N/UI:N); server-side coercion crosses into other systems (S:C) with partial read/write influence (C:L/I:L), no availability impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 17:05 vuln.today

CVE Published

Jul 27, 2026 - 13:59 cve.org

HIGH 7.2

DescriptionCVE.org

Unauthenticated Server Side Request Forgery (SSRF) in 3D Flipbook PDF Viewer & Embedder <= 1.4.2 versions.

AnalysisAI

Unauthenticated server-side request forgery in the WordPress plugin '3D Flipbook PDF Viewer & Embedder' affects all versions up to and including 1.4.2, allowing any remote attacker to make the victim site's web server issue outbound HTTP requests to destinations of the attacker's choosing. Exploitation requires only that the plugin be installed and active and that its PDF-fetch/embed endpoint be reachable over the network; the CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N vector (7.2) confirms no credentials and no user interaction are needed, and the changed scope (S:C) reflects that the impact can extend to systems beyond the vulnerable plugin. No public exploit code has been identified at time of analysis, CISA KEV does not list this CVE, SSVC reports Exploitation: none, and EPSS is low at 0.19% (9th percentile), so the practical risk is moderate and driven mainly by the value of internal services or cloud metadata endpoints reachable from the WordPress host.

Technical ContextAI

The flaw is a CWE-918 server-side request forgery rooted in the WordPress plugin's PDF fetching/embedding functionality, which accepts a caller-supplied resource location and causes the server itself to perform the request without adequately validating or restricting the destination. Because the request originates from the WordPress host, it can be aimed at internal-only resources that are otherwise unreachable from the internet, such as loopback services, RFC1918 addresses, or the cloud instance metadata endpoint at 169.254.169.254. The CPE string cpe:2.3:a:shahadat_hossain:3d_flipbook_pdf_viewer_&_embedder confirms the affected component is the plugin maintained under the shahadat_hossain namespace within the WordPress ecosystem, and the SSRF class explains why the CVSS vector scores scope as changed (S:C) while confidentiality and integrity remain low (C:L/I:L): the plugin's own security boundary is not breached, but the server may be coerced into reading or acting on third-party resources. SSVC classifies the issue as automatable with partial technical impact, while the Patchstack attribution and ENISA EUVD record (EUVD-2026-49221) corroborate that this is a WordPress plugin-layer issue rather than a core or hosting-stack defect.

RemediationAI

No vendor-released patch has been identified at time of analysis, so until a fixed release appears the most reliable action is to deactivate and, if it is not business-critical, remove the '3D Flipbook PDF Viewer & Embedder' plugin from any WordPress site that does not strictly need it; the trade-off is loss of the PDF flipbook/embedding feature. If the plugin must remain active, apply network-layer compensating controls: enforce outbound egress filtering on the WordPress host so the web server can only reach approved external destinations, explicitly block requests to link-local and internal ranges (169.254.169.254, 127.0.0.0/8, and RFC1918 space), and where the site runs on AWS migrate to or enforce IMDSv2 to defeat metadata theft via SSRF; the trade-off is that overly strict egress rules can break legitimate plugin fetches and other integrations, so allowlisting rather than blanket blocking is preferable. Deploying WAF or reverse-proxy rules that inspect and reject user-supplied URL parameters passed to the plugin's PDF-fetch endpoint reduces exposure but is bypassable and should be treated as a secondary layer. Monitor web server and proxy logs for anomalous outbound requests originating from the WordPress process, and track the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/pdf-embed-viewer/vulnerability/wordpress-3d-flipbook-pdf-viewer-embedder-plugin-1-4-2-server-side-request-forgery-ssrf-vulnerability?_s_id=cve and the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-59552 for a confirmable fixed version before re-enabling the plugin.