The WPBookit WordPress plugin lacks an authorization check on the 'get_customer_list' route, enabling unauthenticated attackers to retrieve private customer details such as names, email addresses, phone numbers, dates of birth, and gender. This vulnerability falls under the confidential information disclosure weakness, classified as CWE‑200.

Any WordPress installation running the WPBookit plugin version 1.0.8 or earlier from IQonicDesign is affected. The issue exists in all released versions up to and including 1.0.8 and requires a plugin update to remediate.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The vulnerability can be exploited via a simple HTTP request to the exposed REST endpoint, with no authentication required. It is not listed in the CISA KEV catalog, further suggesting limited current exploitation awareness. Nonetheless, the potential for exposure of personally identifiable information warrants prompt action.