Security Alert Summary
The WPBookit plugin for WordPress contains a missing authorization check on the get_customer_list route in all versions up to and including 1.0.8. This allows unauthenticated users to retrieve customer data such as names, email addresses, phone numbers, dates of birth, and gender.
CVE Details
- CVE ID: CVE-2026-1980
- Affected plugin / component: WPBookit plugin for WordPress
- Affected versions: All versions up to and including 1.0.8
- Published: March 4, 2026 at 2:15:54 AM
- Last modified: March 4, 2026 at 2:15:54 AM
- CVSS v3.1: Base score 5.3, MEDIUM — vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Authentication / Privileges / User Interaction: No authentication required; privileges required: None; user interaction: None
- Primary impact (CIA): Confidentiality: Low; Integrity: None; Availability: None
- CWE: CWE-200
Technical Details
According to the CVE entry, the vulnerability is a missing authorization check on the get_customer_list route. Because the route lacks proper access control, unauthenticated requests can retrieve customer records. The disclosed data fields include names, email addresses, phone numbers, dates of birth, and gender. The issue is present in all versions up to and including 1.0.8. The CVE does not specify the exact function names beyond the route nor provide a fixed version.
How This Could Impact Your Website
Consider a site with multiple users: a site owner who manages plugins and settings, internal staff who handle bookings and customer records, and an external contractor who assists with site maintenance. If the WPBookit get_customer_list route is accessible without authorization, an unauthenticated actor could enumerate and download customer contact details. This exposure can increase the risk of targeted phishing or social engineering against your customers and may reveal personally identifiable information that your staff expects to keep private.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles and capabilities, especially contributor-level accounts and accounts that can access booking data.
- Enforce strong passwords and two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and access logs for unusual requests to administrative or API routes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146
- https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve
