The vulnerability identified as CVE-2026-1314 in the iberezansky 3D FlipBook WordPress plugin is due to a missing capability check in the send_post_pages_json() function. This flaw allows unauthenticated users to retrieve metadata for flipbook pages that should be restricted, such as draft, private, and password-protected content. The issue affects all plugin versions up to 1.16.17. The CVSS 3.1 base score is 5.3, reflecting a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and limited confidentiality impact. No official patch or vendor advisory detailing remediation is currently available.

An attacker without authentication can access metadata of restricted flipbook pages, potentially exposing sensitive information about unpublished or protected content. The vulnerability does not allow modification or disruption of the plugin or system, limiting the impact to confidentiality only. There are no known active exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider restricting access to the plugin or disabling it if possible to prevent unauthorized metadata disclosure. Monitor vendor channels for updates or patches addressing this vulnerability.