Real3D Flipbook EUVD-2026-85046

Requires an authenticated account with Author-level capabilities or higher on the target site running Real3D Flipbook before 5.4; the plugin fails to perform capability checks on several flipbook-management actions. Exploitation is limited by needing that authenticated foothold (not open to anonymous visitors) and, for the XSS payoff, by requiring a victim (visitor or administrator) to subsequently view a page that renders the poisoned global settings (UI:R). Sites with only trusted administrators/editors and no lower-trust Author accounts face substantially reduced realistic risk.

This is a genuine but conditional broken-access-control flaw (CWE-862) requiring an authenticated Author-level-or-higher account, so it is not a mass-exploitable perimeter bug. The supplied CVSS 6.8 vector (AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H) is internally inconsistent with the description: it assigns PR:H, but the description explicitly says 'Author-level access and above,' which is a low-privilege authenticated role - PR:L is the honest mapping. The full C:H/I:H/A:H triad also overstates a stored-XSS-plus-content-deletion impact, and because the injected JavaScript executes in an administrator's browser (a higher-privileged security authority than the Author attacker), the scope is arguably S:C rather than S:U. No EPSS score, no CISA KEV listing, and no public POC are present in the input, so there is no evidence of active exploitation or automation. Real-world priority is moderate: it matters most on multi-author sites where untrusted contributors hold Author accounts; single-admin sites face little exposure. Treat as a should-patch, not a drop-everything emergency.

On a multi-author WordPress site, a malicious or compromised Author-level user invokes the plugin's unprotected flipbook-management actions to delete other authors' flipbooks and to overwrite the administrator-only global settings, planting attacker-controlled JavaScript. When an administrator or ordinary visitor next loads a page rendering those global settings, the stored script runs in their browser, enabling session/cookie theft or admin-context actions. No public exploit code is identified at time of analysis; exploitation requires a valid Author account and a victim viewing the affected page (UI:R).