CVE-2024-9849: Creativeinteractivemedia REAL3D Flipbook

High severity, CVSS 8.8. EPSS: 1.2% chance of exploitation in the next 30 days.

The Real3D Flipbook Lite – 3D FlipBook, PDF Viewer, PDF Embedder plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'r3dfb_save_thumbnail_callback' function in all versions up to, and including, 4.8. This makes it possible for authenticated attackers, with Author-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

Affected products

• Creativeinteractivemedia REAL3D Flipbook: up to and including 4.6
• Creativeinteractivemedia Real 3d Flipbook – 3d Flipbook, PDF Flipbook, PDF Viewer, PDF Embedder: up to and including 4.8

Published 2024-11-16. Last modified 2026-06-17.