CVE-2022-0709

Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

State: Published
Severity: Not scored
Published: Apr 4, 2022
Updated: Aug 2, 2024
Reserved: Feb 21, 2022

Description

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

Scores

The record has no CVSS score.

Weaknesses

CWE-200 Information Exposure

Affected Products

Product	Versions
Booking Package – Appointment Booking Calendar SystemUnknown	1.5.29 to before 1.5.29Affected

References

https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.