Real 3D Flipbook – 3D FlipBook, PDF FlipBook, PDF Viewer, PDF Embedder Security & Risk Analysis

The real3d-flipbook-lite plugin version 4.19.2 presents a mixed security posture. While it demonstrates good practices such as using prepared statements for all SQL queries and a very high percentage of properly escaped outputs, there are significant concerns regarding its attack surface. The presence of 3 unprotected AJAX handlers out of a total of 8 entry points is a notable weakness that could be exploited for unauthorized actions. The taint analysis shows no critical or high severity flows, which is positive, but this is contrasted by a concerning vulnerability history.

The plugin has a history of 5 known CVEs, with one still unpatched and classified as high severity. The common vulnerability types, including Missing Authorization, Cross-site Scripting (XSS), and Unrestricted Upload of File with Dangerous Type, suggest recurring security flaws in how user input is handled and access is controlled. The fact that a high-severity vulnerability remains unpatched is a serious red flag. While the plugin has strengths in its data handling (SQL and output escaping), the unpatched vulnerability and unprotected AJAX endpoints create a substantial risk that needs immediate attention.