PT-2026-22859 · WordPress · Wpbookit

Iqonicdesign · Published 2026-03-04 · Updated 2026-03-04 · CVE-2026-1980

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions WPBookit versions up to and including 1.0.8

Description The WPBookit plugin for WordPress has a flaw that allows unauthorized disclosure of customer data. This is due to a missing authorization check on the /get customer list API endpoint. An unauthenticated attacker can retrieve sensitive customer information, including names, emails, phone numbers, dates of birth, and gender.

Recommendations Update WPBookit to a version newer than 1.0.8.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2026-1980

Affected Products

Wpbookit

References · 10

• https://nvd.nist.gov/vuln/detail/CVE-2026-1980 · Security Note
• https://t.me/CVEtracker/46268 · Telegram Post
• https://twitter.com/VulmonFeeds/status/2029039419433332750 · Twitter Post
• https://twitter.com/infoflowcloud/status/2029040666836082844 · Twitter Post
• https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146 · Note
• https://twitter.com/CVEnew/status/2029039198116737361 · Twitter Post
• https://twitter.com/CVEarity/status/2029167396653777006 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve · Note