CVE-2026-1314: 
WordPress vulnerability analysis and mitigation

CVE-2026-1314 is a missing authorization vulnerability in the 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress. It affects all versions up to and including 1.16.17, allowing unauthenticated attackers to retrieve flipbook page metadata for draft, private, and password-protected flipbooks via the send_post_pages_json() function. The vulnerability was published on April 15, 2026, and a patch was added to the GitHub Advisory Database on April 22, 2026. It carries a CVSS v3.1 base score of 5.3 (Medium) (GitHub Advisory, Wordfence).

The root cause is a missing capability check (CWE-862) on the send_post_pages_json() function within the plugin. Because no authorization is enforced before the function executes, any unauthenticated network request can invoke it and receive flipbook page metadata that should be restricted. The attack requires no privileges, no user interaction, and low complexity — an attacker simply needs to send a crafted HTTP request to the exposed WordPress AJAX or REST endpoint that triggers this function. A patch was committed to the WordPress plugin repository at changeset 3467608 (GitHub Advisory, WP Trac).

Successful exploitation results in unauthorized disclosure of flipbook page metadata, including content structure for posts that are in draft, set to private, or protected by a password. While integrity and availability are unaffected, the confidentiality impact allows attackers to enumerate sensitive or unpublished content that site owners intended to restrict. This could expose business-sensitive documents, unreleased content, or internal materials embedded in flipbooks (GitHub Advisory, Wordfence).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.035% (per Feedly data), indicating a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Notably, Nuclei templates for this CVE were added to the ProjectDiscovery nuclei-templates repository, which may facilitate automated scanning (Nuclei Templates).

1. Reconnaissance: Identify WordPress sites running the 3D FlipBook plugin version ≤ 1.16.17 using tools like WPScan, Shodan, or automated Nuclei templates targeting this CVE.
2. Locate the vulnerable endpoint: Identify the WordPress AJAX action or REST API route that maps to the send_post_pages_json() function (typically via admin-ajax.php with the relevant action parameter).
3. Send unauthenticated request: Craft an HTTP POST or GET request to the endpoint without any authentication credentials or nonce, e.g.:

   POST /wp-admin/admin-ajax.php
   action=<flipbook_action>&post_id=<target_post_id>

4. Retrieve restricted metadata: The server responds with JSON-formatted flipbook page metadata for the targeted post, even if it is a draft, private, or password-protected flipbook, exposing content structure and associated data.

• Network: Unusual or repeated HTTP requests to wp-admin/admin-ajax.php with flipbook-related action parameters from unauthenticated (no session cookie) sources; high-frequency requests targeting multiple post IDs in sequence suggesting enumeration.
• Logs: WordPress access logs showing unauthenticated POST requests to admin-ajax.php with the send_post_pages_json action; responses returning JSON metadata for draft or private posts.
• Process/Behavior: Automated scanning patterns (rapid sequential requests with incrementing post_id values) originating from a single IP or small IP range.

Update the 3D FlipBook plugin to a version newer than 1.16.17, which includes the fix committed in WordPress plugin repository changeset 3467608 (WP Trac). If an immediate update is not possible, consider temporarily deactivating the plugin or using a Web Application Firewall (WAF) rule to block unauthenticated requests to the vulnerable AJAX endpoint. Site administrators should also audit access logs for the send_post_pages_json() function to determine whether unauthorized access has already occurred (Wordfence).

Wordfence included this vulnerability in their weekly WordPress vulnerability report for April 13–19, 2026, and maintains a dedicated threat intelligence entry for it (Wordfence Blog). Sucuri also referenced it in their April 2026 vulnerability patch roundup (Sucuri Blog). Community interest was modest, with the CVE appearing in automated aggregators and a Bluesky post, consistent with a medium-severity WordPress plugin issue.