Suredsi Ulpada

**Name of the Vulnerable Software and Affected Versions** 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery versions prior to 1.16.21 **Description** Unauthenticated attackers can extract sensitive data from password-protected flipbooks by exploiting the `id` parameter. This allows the retrieval of the full metadata payload, including the title, outline, props, and the serialized data blob containing the direct URL of the underlying PDF file, which bypasses WordPress post-password confidentiality. Additionally, flipbook post IDs can be pre-enumerated using the unauthenticated `fb3d send posts` AJAX action. **Recommendations** Update the plugin to a version later than 1.16.20.