CVE-2024-4744: Medium Access Control Gap in iPages Flipbook Plugin

CVE-2024-4744 is a medium severity missing authorization flaw in the iPages Flipbook WordPress plugin by Avirtum, scored 5.3. It affects versions through 1.5.1. Patchstack reports it patched in version 1.5.2, so update the plugin to 1.5.2 or later, or remove it if you do not use it.

What's affected

The record says iPages Flipbook is affected from n/a through 1.5.1. Patchstack's database page lists the affected versions as 1.5.1 and below, patched in 1.5.2, and classifies the flaw as Broken Access Control (OWASP A1). The weakness is CWE-862, missing authorization. Patchstack gives it low priority and describes it as unlikely to be exploited.

On severity, NVD scores it 5.3 Medium. Patchstack labels it low severity impact. The two ratings differ in wording, so report both. The KEV flag is false and none of the sources claim exploitation.

Patchstack's page also notes that the plugin has no vulnerability disclosure program, and it records the publication date as 10 May 2024.

How to check if you're exposed

1. In WordPress, open Plugins, then Installed Plugins, and look for iPages Flipbook.
2. Read the version. If it is 1.5.1 or lower, you are in range.
3. If you manage many sites, list plugins from the command line with WP-CLI by running wp plugin list on each site, and look for the plugin and its version.
4. Check multisite networks as well, because the plugin may be active on only some sites.

An inventory of plugins across your WordPress estate is the part most teams lack. Keep one, with versions, so a new advisory takes minutes to triage.

What to do now

1. Update iPages Flipbook to 1.5.2 or later from the WordPress dashboard.
2. If you do not use the flipbook feature, deactivate and delete the plugin.
3. Turn on automatic updates for plugins you rely on, where your change process allows.
4. Review the site for flipbook content that was changed without your knowledge.
5. Read the Patchstack page for the vendor's change details.

Why it matters

Missing authorization means the code does the work without first asking whether the caller is allowed. In WordPress plugins this often involves an action or endpoint that checks a login but not a capability. The result is that a user, or sometimes a visitor, can do things meant for editors or admins.

The score is moderate and the vendor's own research calls exploitation unlikely, which is a fair reason to schedule the update instead of rushing it. Plugins that are forgotten are the real risk, because a medium flaw left for a year is easier to chain with something else.

Quick check

Sources

• Patchstack database entry for iPages Flipbook 1.5.1
• NVD record data for CVE-2024-4744

Last reviewed: 19 October 2026.