# Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder <= 5.5 - Authenticated (Author+) Arbitrary File Deletion via 'lightboxThumbnailUrl'

- **ID:** WPSEC-2026-0913
- **Plugin:** Real3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder (`real3d-flipbook-lite`), https://wordpress.org/plugins/real3d-flipbook-lite/
- **Affected versions:** from 4.10.2 before 5.7
- **Fixed in:** 5.7 (Update to 5.7 or later.)
- **Severity:** High 8.1 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H)
- **Weakness:** CWE-22
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-14)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/real3d-flipbook-lite
- **Fix released:** 2026-10-13
- **Published:** 2026-10-14
- **URL:** https://wpsec.com/vuln/WPSEC-2026-0913/

## Description

The Real3D Flipbook plugin for WordPress is vulnerable to arbitrary file deletion via the 'lightboxThumbnailUrl' flipbook option in all versions up to, and including, 5.5. This is due to insufficient file path validation in the r3dfb_save_thumbnail_callback() function. When a new thumbnail is uploaded, the function builds a path from the stored, user-controlled 'lightboxThumbnailUrl' value with a simple string replacement and deletes that file if it exists. This makes it possible for authenticated attackers with Author-level access and above to delete arbitrary files on the server, which can lead to remote code execution when a critical file such as wp-config.php is deleted.

## References

- https://wpsec.com/vuln/WPSEC-2026-0913/
- https://plugins.svn.wordpress.org/real3d-flipbook-lite/tags/5.7/
- https://wordpress.org/plugins/real3d-flipbook-lite/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-0913/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.