CVE-2024-9849

Name of the Vulnerable Software and Affected Versions 3D FlipBook, PDF Viewer, PDF Embedder – Real 3D FlipBook WordPress Plugin versions up to 4.6

Description The issue arises from missing file type validation in the r3dfb save thumbnail callback function, allowing authenticated attackers with Author-level access and above to upload arbitrary files on the affected site's server. This may make remote code execution possible.

Recommendations For versions up to 4.6, update the plugin to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the r3dfb save thumbnail callback function until a patch is available. Restrict file uploads to only necessary file types to minimize the risk of exploitation.