WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure
CVE-2026-1980
Verified
Description
WPBookit WordPress plugin <= 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'get_customer_list' route, letting unauthenticated attackers retrieve sensitive customer data.
Severity
Medium
CVSS Score
5.3
Exploit Probability
1%
Affected Product
wpbookit
Published Date
July 20, 2026
Template Author
aryu-ru
CVE-2026-1980.yaml
5.3Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2026-1980
CWE ID:
cwe-200
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cvehttps://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146https://nvd.nist.gov/vuln/detail/CVE-2026-1980https://wordpress.org/plugins/wpbookit/
Remediation Steps
Update to the latest version beyond 1.0.8.