The vulnerability is a classic insertion of sensitive information into sent data that allows an attacker to retrieve embedded sensitive content. Because the flaw resides in the plugin code, a compromised site could leak confidentiality of data stored or configured within the plugin, such as document identifiers, internal URLs, or custom data stored in the flipbook views. The weakness is classified as CWE-201, a data exposure issue due to unsanitized output.

The affected product is iberezansky 3D FlipBook – PDF Flipbook Viewer, Flipbook Image Gallery for WordPress. All installations running any version from the earliest available release up to and including version 1.16.16 are affected. No other versions or vendors are indicated.

The CVSS score of 5.3 places this vulnerability in the medium severity range, but the EPSS score of less than 1% indicates that large‑scale exploitation is unlikely at present. It is not listed in the CISA KEV catalog. The likely attack vector is via a publicly accessible WordPress site that has the plugin activated, allowing an unauthenticated attacker to request a flipbook resource and receive the embedded sensitive data.