Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Authenticated (Author+) Arbitrary File Deletion via 'lightboxThumbnailUrl'
- ID
- WPSEC-2026-0913
- Plugin
- Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder (real3d-flipbook-lite)
- Affected
- from 4.10.2 before 5.7
- Remediation
- Update to 5.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
- Weakness
- CWE-22
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-14
- Attack surface
- Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder on WPSec AttackSurface
- Fix released
- Published
Description
The Real3D Flipbook plugin for WordPress is vulnerable to arbitrary file deletion via the 'lightboxThumbnailUrl' flipbook option in all versions up to, and including, 5.5. This is due to insufficient file path validation in the r3dfb_save_thumbnail_callback() function. When a new thumbnail is uploaded, the function builds a path from the stored, user-controlled 'lightboxThumbnailUrl' value with a simple string replacement and deletes that file if it exists. This makes it possible for authenticated attackers with Author-level access and above to delete arbitrary files on the server, which can lead to remote code execution when a critical file such as wp-config.php is deleted.
References
- https://wpsec.com/vuln/WPSEC-2026-0913/
- https://plugins.svn.wordpress.org/real3d-flipbook-lite/tags/5.7/
- https://wordpress.org/plugins/real3d-flipbook-lite/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS