3D Flipbook Pdf Embedder Pdf Flipbook Viewer Flipbook Image Gallery
Monthly
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.
Unauthenticated information disclosure in the 3D FlipBook - PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery WordPress plugin (all versions ≤1.16.20) allows any remote attacker to retrieve the full metadata payload of password-protected flipbooks - including title, outline, props, and the serialized data blob containing the underlying PDF file's direct URL - bypassing WordPress post-password confidentiality entirely. The plugin's AJAX handler in inc/ajax-get.php processes the 'id' parameter without verifying that the requestor has authenticated against the post password, and a companion unauthenticated AJAX action (fb3d_send_posts) enables systematic enumeration of all flipbook post IDs with no prior knowledge of the target site's content structure. No public exploit code and no CISA KEV listing exist at time of analysis.