Authentication Bypass in Real3D Flipbook WordPress Plugin
CVE-2026-86842
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 23 September 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-86842?
The Real3D Flipbook plugin for WordPress, prior to version 5.4, lacks proper capability checks for several authenticated management actions. This oversight enables users with Author-level access or higher to delete flipbook content created by other users and modify global settings, typically restricted to administrators. This vulnerability can be exploited to inject malicious JavaScript, facilitating potential attacks that execute in the context of any visitor or administrator accessing the site.
Affected Version(s)
Real3D Flipbook 0 < 5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.