CVE-2022-0709: Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-04-04 · updated 2026-06-17
Weakness: CWE-200

Description

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

Affected products

SaasProject Booking Package: before 1.5.29 — fixed in 1.5.29

How to fix

Upgrade to a fixed version: SaasProject Booking Package 1.5.29. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85
https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85

Get alerted when CVE-2022-0709 or the next vulnerability affects your stack