{
 "id": "WPSEC-2026-0913",
 "url": "https://wpsec.com/vuln/WPSEC-2026-0913/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-0913/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-0913/index.md",
 "title": "Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Authenticated (Author+) Arbitrary File Deletion via 'lightboxThumbnailUrl'",
 "description": "The Real3D Flipbook plugin for WordPress is vulnerable to arbitrary file deletion via the 'lightboxThumbnailUrl' flipbook option in all versions up to, and including, 5.5. This is due to insufficient file path validation in the r3dfb_save_thumbnail_callback() function. When a new thumbnail is uploaded, the function builds a path from the stored, user-controlled 'lightboxThumbnailUrl' value with a simple string replacement and deletes that file if it exists. This makes it possible for authenticated attackers with Author-level access and above to delete arbitrary files on the server, which can lead to remote code execution when a critical file such as wp-config.php is deleted.",
 "plugin": {
  "slug": "real3d-flipbook-lite",
  "name": "Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder",
  "full_name": "Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder",
  "wordpress_org": "https://wordpress.org/plugins/real3d-flipbook-lite/",
  "advisories_url": "https://wpsec.com/vuln/plugin/real3d-flipbook-lite/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/real3d-flipbook-lite"
 },
 "type": "FILE DELETION",
 "cwe": [
  "CWE-22"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 8.1,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
  "severity": "High"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.10.2",
    "from_inclusive": true,
    "to": "5.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.10.2 before 5.7"
  ]
 },
 "introduced_in": "4.10.2",
 "fixed_in": "5.7",
 "remediation": "Update to 5.7 or later.",
 "fix_released": "2026-10-13T09:29:28+00:00",
 "published": "2026-10-14T13:49:25+00:00",
 "updated": "2026-10-14T13:19:39.685481+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-0913/",
  "https://plugins.svn.wordpress.org/real3d-flipbook-lite/tags/5.7/",
  "https://wordpress.org/plugins/real3d-flipbook-lite/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/real3d-flipbook-lite",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Medium",
  "affected_versions": "Medium",
  "as_of": "2026-10-14"
 }
}