{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-25423", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "state": "PUBLISHED", "assignerShortName": "Patchstack", "dateReserved": "2026-02-02T12:53:26.262Z", "datePublished": "2026-02-19T08:27:07.440Z", "dateUpdated": "2026-04-28T16:14:58.617Z"}, "containers": {"cna": {"affected": [{"collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected", "packageName": "real3d-flipbook-lite", "product": "Real 3D FlipBook", "vendor": "creativeinteractivemedia", "versions": [{"changes": [{"at": "4.19.2", "status": "unaffected"}], "lessThanOrEqual": "4.19.1", "status": "affected", "version": "0", "versionType": "custom"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "datePublic": "2026-04-01T16:05:09.917Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.</p>"}], "value": "Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1."}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-862", "description": "Missing Authorization", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:58.617Z"}, "references": [{"tags": ["vdb-entry"], "url": "https://patchstack.com/database/Wordpress/Plugin/real3d-flipbook-lite/vulnerability/wordpress-real-3d-flipbook-plugin-4-16-4-broken-access-control-vulnerability?_s_id=cve"}], "title": "WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability"}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-02-19T18:29:44.383745Z", "id": "CVE-2026-25423", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-28T13:55:55.625Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-25423", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-02-19T18:29:44.383745Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-02-19T18:28:54.224Z"}}], "cna": {"title": "WordPress Real 3D FlipBook plugin <= 4.19.1 - Broken Access Control vulnerability", "credits": [{"lang": "en", "type": "finder", "value": "Nabil Irawan | Patchstack Bug Bounty Program"}], "impacts": [{"capecId": "CAPEC-180", "descriptions": [{"lang": "en", "value": "Exploiting Incorrectly Configured Access Control Security Levels"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.8, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "HIGH", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "creativeinteractivemedia", "product": "Real 3D FlipBook", "versions": [{"status": "affected", "changes": [{"at": "4.19.2", "status": "unaffected"}], "version": "0", "versionType": "custom", "lessThanOrEqual": "4.19.1"}], "packageName": "real3d-flipbook-lite", "collectionURL": "https://wordpress.org/plugins", "defaultStatus": "unaffected"}], "datePublic": "2026-04-01T16:05:09.917Z", "references": [{"url": "https://patchstack.com/database/Wordpress/Plugin/real3d-flipbook-lite/vulnerability/wordpress-real-3d-flipbook-plugin-4-16-4-broken-access-control-vulnerability?_s_id=cve", "tags": ["vdb-entry"]}], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.", "supportingMedia": [{"type": "text/html", "value": "Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.<p>This issue affects Real 3D FlipBook: from n/a through <= 4.19.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-862", "description": "Missing Authorization"}]}], "providerMetadata": {"orgId": "21595511-bba5-4825-b968-b78d1f9984a3", "shortName": "Patchstack", "dateUpdated": "2026-04-28T16:14:58.617Z"}}}, "cveMetadata": {"cveId": "CVE-2026-25423", "state": "PUBLISHED", "dateUpdated": "2026-04-28T16:14:58.617Z", "dateReserved": "2026-02-02T12:53:26.262Z", "assignerOrgId": "21595511-bba5-4825-b968-b78d1f9984a3", "datePublished": "2026-02-19T08:27:07.440Z", "assignerShortName": "Patchstack"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Missing Authorization vulnerability in creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Real 3D FlipBook: from n/a through <= 4.19.1."}, {"lang": "es", "value": "Vulnerabilidad por falta de autorizaci\u00f3n en creativeinteractivemedia Real 3D FlipBook real3d-flipbook-lite permite explotar niveles de seguridad de control de acceso incorrectamente configurados. Este problema afecta a Real 3D FlipBook: desde n/a hasta &lt;= 4.16.4."}], "id": "CVE-2026-25423", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 3.8, "baseSeverity": "LOW", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 2.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2026-02-19T09:16:24.020", "references": [{"source": "audit@patchstack.com", "url": "https://patchstack.com/database/Wordpress/Plugin/real3d-flipbook-lite/vulnerability/wordpress-real-3d-flipbook-plugin-4-16-4-broken-access-control-vulnerability?_s_id=cve"}], "sourceIdentifier": "audit@patchstack.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-862"}], "source": "audit@patchstack.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.16.4]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "inferred"}, {"score": 99.0, "source": "matching"}]}, "original": {"product": "Real 3D FlipBook", "source": "cna", "vendor": "creativeinteractivemedia"}, "product": "real3d_flipbook", "vendor": "creativeinteractivemedia"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": null}], "enrichment": {"confidence": 80.0, "confidence_source": "inferred", "scores": [{"score": 80.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "product": "wordpress", "vendor": "wordpress"}], "analysis": {"en": {"generated_at": "2026-04-16T00:13:15.133122+00:00", "value": {"mitigation_remediation": ["Upgrade the Real\u202f3D\u202fFlipBook Lite plugin to a version newer than 4.19.1 (or remove the plugin if an update is unavailable).", "Restrict plugin functionality by ensuring only administrators have access to the flip\u2011book administration pages.", "Verify that all WordPress user roles have permissions aligned with your security policy and remove unused administrative accounts."], "summary": {"action": "Apply Update", "impact": "Broken Access Control"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Real\u202f3D\u202fFlipBook Lite plugin made by creativeinteractivemedia. All releases up to and including version\u202f4.19.1 are impacted. Sites running WordPress with this plugin installed are potentially exposed.", "description_and_impact": "An unauthenticated or improperly authenticated attacker can exploit a missing authorization check within the Real\u202f3D\u202fFlipBook plugin. The flaw permits bypassing the plugin\u2019s intended role\u2011based limits, allowing the attacker to modify, create, or delete flip\u2011book content and settings. This undermines confidentiality and integrity of the content managed by the plugin and could increase the scope of compromise to the entire WordPress site if the attacker gains further privileges.", "risk_and_exploitability": "The CVSS score is 3.8, classifying the risk as low. The EPSS score of less than 1\u202f% indicates a very low probability of real\u2011world exploitation at this time, and the vulnerability is not listed in CISA\u2019s Known Exploited Vulnerabilities catalog. The attack requires the plugin to be active on a WordPress installation and an attacker to find a way to trigger the unauthenticated access path, which is not explicitly documented; the likely vector is through the web interface of the plugin. While the flaw does not allow remote code execution, an attacker who succeeds could gain significant control over the plugin\u2019s content management features."}}}}, "created": "2026-02-20T10:08:17.207813+00:00", "updated": "2026-04-16T00:15:18.641745+00:00", "vendors": ["creativeinteractivemedia", "creativeinteractivemedia$PRODUCT$real3d_flipbook", "wordpress", "wordpress$PRODUCT$wordpress"]}