What is the CVSS score of CVE-2026-1980?

CVE-2026-1980 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N. EPSS exploitation probability: 0.1%.

Which versions of WordPress are affected by CVE-2026-1980?

Organizations using all should be aware of moderate risk from CVE-2026-1980, a information exposure vulnerability rated CVSS 5.3. Sensitive information could be exposed to unauthorized parties.

Is there a public PoC exploit available for CVE-2026-1980?

Yes, a public proof-of-concept exploit is available for CVE-2026-1980. Prioritise patching immediately. EPSS: 0.1%.

How to fix or mitigate CVE-2026-1980?

Within 30 days: Identify affected systems running all and apply vendor patches as part of regular patch cycle. Review data exposure and access controls.

WordPress CVE-2026-1980

MEDIUM

Information Exposure (CWE-200)

2026-03-04 security@wordfence.com

WordPress Information Disclosure

5.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:05 vuln.today

CVE Published

Mar 04, 2026 - 02:15 nvd

MEDIUM 5.3

DescriptionCVE.org

The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.

AnalysisAI

Unauthenticated attackers can extract sensitive customer data from WPBookit plugin versions 1.0.8 and earlier through an authorization bypass in the 'get_customer_list' endpoint, exposing names, emails, phone numbers, dates of birth, and gender information. This network-accessible vulnerability affects all WordPress installations running the vulnerable plugin without requiring authentication or user interaction. No patch is currently available.

Technical ContextAI

Classified as CWE-200 (Information Exposure). Affects WPBookit (WordPress plugin). The WPBookit plugin for WordPress is vulnerable to unauthorized data disclosure due to a missing authorization check on the 'get_customer_list' route in all versions up to, and including, 1.0.8. This makes it possible for unauthenticated attackers to retrieve sensitive customer information including names, emails, phone numbers, dates of birth, and gender.