CVE-2026-1980
Authorization Bypass in WPBookit Plugin Exposes Customer Data
Publication date: 2026-03-04
Last updated on: 2026-03-04
Assigner: Wordfence
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wpbookit | wpbookit | to 1.0.8 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-200 | The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The WPBookit plugin for WordPress has a vulnerability due to a missing authorization check on the 'get_customer_list' route in all versions up to and including 1.0.8.
This flaw allows unauthenticated attackers to access sensitive customer information such as names, emails, phone numbers, dates of birth, and gender without proper permission.
How can this vulnerability impact me? :
This vulnerability can lead to unauthorized disclosure of sensitive customer data, exposing personal information like names, emails, phone numbers, dates of birth, and gender.
Such data exposure can result in privacy breaches, identity theft, phishing attacks, and damage to the reputation of the affected organization.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability involves unauthorized access to the 'get_customer_list' route in the WPBookit plugin, which does not require authentication or authorization checks.
To detect exploitation attempts on your network or system, you can monitor HTTP requests targeting the 'get_customer_list' endpoint of the WPBookit plugin.
Suggested commands include using network monitoring or web server log analysis tools to search for requests to this route.
- Using grep on web server logs to find access attempts: grep 'get_customer_list' /path/to/access.log
- Using curl to test if the route is accessible without authentication: curl -v https://yourwordpresssite.com/wp-admin/admin-ajax.php?action=get_customer_list
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include restricting access to the vulnerable 'get_customer_list' route by applying proper authorization checks.
You should update the WPBookit plugin to a version that includes a fix for this vulnerability if available.
If an update is not yet available, consider temporarily disabling the WPBookit plugin or blocking access to the vulnerable route via web server rules.
- Apply firewall or web server rules to block requests to the 'get_customer_list' route.
- Limit access to the WordPress admin AJAX endpoint to authenticated users only.