CVE-2026-1980 describes an information disclosure vulnerability in the WPBookit plugin for WordPress by iqonicdesign. The issue arises from a missing authorization check on the 'get_customer_list' API route, which permits unauthenticated users to retrieve sensitive customer information. This affects all versions up to and including 1.0.8. The vulnerability has a CVSS 3.1 score of 5.3 (medium severity), with an attack vector of network (remote), no privileges required, and no user interaction needed. The vulnerability impacts confidentiality but does not affect integrity or availability.

An attacker can remotely access sensitive customer information without authentication, potentially leading to privacy violations and unauthorized data exposure. The compromised data includes personally identifiable information (PII) such as names, emails, phone numbers, dates of birth, and gender. There is no indication of impact on system integrity or availability. No known exploits have been reported in the wild to date.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected API route by implementing custom authorization controls or disabling the 'get_customer_list' route if possible. Monitor vendor channels for updates and apply official patches promptly once available.