An unauthenticated or improperly authenticated attacker can exploit a missing authorization check within the Real 3D FlipBook plugin. The flaw permits bypassing the plugin’s intended role‑based limits, allowing the attacker to modify, create, or delete flip‑book content and settings. This undermines confidentiality and integrity of the content managed by the plugin and could increase the scope of compromise to the entire WordPress site if the attacker gains further privileges.

The vulnerability affects the Real 3D FlipBook Lite plugin made by creativeinteractivemedia. All releases up to and including version 4.19.1 are impacted. Sites running WordPress with this plugin installed are potentially exposed.

The CVSS score is 3.8, classifying the risk as low. The EPSS score of less than 1 % indicates a very low probability of real‑world exploitation at this time, and the vulnerability is not listed in CISA’s Known Exploited Vulnerabilities catalog. The attack requires the plugin to be active on a WordPress installation and an attacker to find a way to trigger the unauthenticated access path, which is not explicitly documented; the likely vector is through the web interface of the plugin. While the flaw does not allow remote code execution, an attacker who succeeds could gain significant control over the plugin’s content management features.