The 3D FlipBook plugin for WordPress contains a missing capability check on the send_post_pages_json() function. As a result, unauthenticated users can call this endpoint and retrieve metadata about flipbook pages that are draft, private, or password‑protected. This flaw exposes confidential content without requiring any authentication or privilege escalation, leading to potential information disclosure and privacy violations.

WordPress sites that have installed the "3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery" plugin from vendor iberezansky. Versions up to and including 1.16.17 are affected; any installation using these or earlier releases is vulnerable.

The vulnerability is scored 5.3 on CVSS, indicating moderate severity. Exploitability is likely high because the flaw relies solely on a missing authorization check and does not require any additional conditions. With limited publicly reported exploitation, the risk remains plausible for targeted attacks that can easily enumerate private flipbooks over the network.