Medium severity6.8NVD Advisory· Published Sep 23, 2026· Updated Sep 23, 2026
CVE-2026-86842
CVE-2026-86842
Description
The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users with Author-level access and above to delete other users' flipbook content and overwrite administrator-only global settings, which can be leveraged to store JavaScript that executes in the context of any visitor or administrator viewing the site.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
1- Range: <5.4
Patches
Vulnerability mechanics
References
1News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (September 21, 2026 to September 27, 2026)Wordfence Blog · Oct 1, 2026