Knight Squad Academy
Vulnerability advisory

CVE-2026-1980

Research by Md. Tareq Ahamed Jony March 4, 2026
Overview

Summary

The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.

Risk profile

CVSS assessment

5.3 · M E D I U M
Vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
N E T W O R K
Complexity
L O W
Privileges
N O N E
User interaction
N O N E
Scope
U N C H A N G E D
Confidentiality
L O W
Integrity
N O N E
Availability
N O N E
Classification

Weaknesses

  • Exposure of Sensitive Information to an Unauthorized Actor CWE-200
Further reading

References

4 sources
  1. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146
  2. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/browser/wpbookit/trunk/core/admin/classes/class.wpb-admin-routes.php#L146
  3. plugins.trac.wordpress.org https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3467556%40wpbookit&new=3467556%40wpbookit&sfp_email=&sfph_mail=
  4. www.wordfence.com https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve