medium6.8
CVE-2026-86842
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users …
Impact
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
Affected products
| Product | Affected versions |
|---|---|
| Real3D Flipbook WordPress Plugin | before 5.4 |
Versions were read from the advisory text. No structured product data has been published for this record yet.