Booking Package, CVE-2022-0709

CVE, Research URL: CVE-2022-0709
Home page URL: Security reports for Booking Package
Application: Booking Package
Published on: Apr 04, 2022
Research Description: The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Affected versions: Min -, max 1.5.99.
Status: vulnerable