[ CVE-2026-86842 · Published 23 Sep 2026 ]
Vulnerability in Unknown Real3D Flipbook
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.