CVE-2026-1980: WPBookit <= 1.0.8 - Missing Authorization to Unauthenticated Sensitive Customer Data Exposure

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2026-03-04 · updated 2026-06-17
Weakness: CWE-200

Description

The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.

Affected products

iqonicdesign WPBookit: through 1.0.8

References

https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146
https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146
https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail=
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve

Get alerted when CVE-2026-1980 or the next vulnerability affects your stack