CVE-2026-1314
Medium3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure
Published Apr 14, 2026 · Updated Apr 15, 2026 · Also known as d7e41753-2dbf-4afa-b61e-e617be2c4dc2
Key Facts
Routine patching- CVE-2026-1314 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting interactive-3d-flipbook-powered-physics-engine (wordpress-plugin), 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 0.9% probability of exploitation in the next 30 days.
- Fixed versions are available, including interactive-3d-flipbook-powered-physics-engine 1.16.18.
- Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
EPSS (30-day exploit likelihood)
0.9%
Higher than 58.7% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2026-1314 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17. This makes it possible for unauthenticated attackers to retrieve flipbook page metadata for draft, private and password-protected flipbooks.
Affected Products
2 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| interactive-3d-flipbook-powered-physics-enginewordpress-plugin | See advisory | 1.16.18 |
| 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery | See advisory | n/a |
Patched Releases
interactive-3d-flipbook-powered-physics-engine
1.16.18
Timeline
Publicly disclosed
Apr 14, 2026
Last updated
Apr 15, 2026
Weakness Type
- CWE-862 Missing Authorization
References
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/d7e41753-2dbf-4afa-b61e-e617be2c4dc2?source=api-prod
- advisoryhttps://www.wordfence.com/threat-intel/vulnerabilities/id/d7e41753-2dbf-4afa-b61e-e617be2c4dc2?source=api-scan
- otherhttps://plugins.trac.wordpress.org/changeset/3467608/
- otherhttps://www.wordfence.com/threat-intel/vulnerabilities/id/d7e41753-2dbf-4afa-b61e-e617be2c4dc2?source=cve
FAQ
Common Questions.
The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the send_post_pages_json() function in all versions up to, and including, 1.16.17.
Affected: interactive-3d-flipbook-powered-physics-engine (wordpress-plugin); 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including interactive-3d-flipbook-powered-physics-engine 1.16.18.
Brandefense priority: routine patching, as no exploitation is known and its severity is moderate or low.
Is CVE-2026-1314 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo