Medium severity · published Mar 4, 2026
CVE-2026-1980
WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure
5.3
CVSS
0.8%
EPSS
No
On KEV
Description
The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 58% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WP
WPBookit · iqonicdesign
through 1.0.8 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-1980
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-1980
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146
plugins.trac.wordpress.org
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail=
www.wordfence.com
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve
More from WPBookit
9.8
CVE-2025-7852
WPBookit <= 1.0.6 - Unauthenticated Arbitrary File Upload via image_upload_handle Function
9.8
CVE-2025-6058
WPBookit <= 1.0.4 - Unauthenticated Arbitrary File Upload
9.8
CVE-2025-3811
WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Email Update
9.8
CVE-2025-3810
WPBookit <= 1.0.2 - Insecure Direct Object Reference to Unauthenticated Privilege Escalation via Account Takeover
8.8
CVE-2025-6057
WPBookit <= 1.0.4 - Authenticated (Subscriber+) Arbitrary File Upload