PT-2026-22859 · WordPress · Wpbookit

Iqonicdesign · Publicado 2026-03-04 · Atualizado 2026-03-04 · CVE-2026-1980

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPBookit versions up to and including 1.0.8

Description The WPBookit plugin for WordPress has a flaw that allows unauthorized disclosure of customer data. This is due to a missing authorization check on the /get customer list API endpoint. An unauthenticated attacker can retrieve sensitive customer information, including names, emails, phone numbers, dates of birth, and gender.

Recommendations Update WPBookit to a version newer than 1.0.8.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2026-1980

Produtos afetados

Wpbookit

Referências · 10

• https://t.me/CVEtracker/46268 · Publicação no Telegram
• https://twitter.com/VulmonFeeds/status/2029039419433332750 · Publicação no Twitter
• https://twitter.com/infoflowcloud/status/2029040666836082844 · Publicação no Twitter
• https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146 · Nota
• https://twitter.com/CVEnew/status/2029039198116737361 · Publicação no Twitter
• https://twitter.com/CVEarity/status/2029167396653777006 · Publicação no Twitter
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail= · Nota
• https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-1980 · Nota de Segurança
• https://wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve · Nota