CVE-2022-0709: Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2022-0709?
CVE-2022-0709 is a vulnerability in the Booking Package WordPress plugin before version 1.5.29 that allows unauthenticated users to obtain sensitive data.
How severe is CVE-2022-0709?
CVE-2022-0709 has a severity rating of 7.5, which is considered high.
Which software is affected by CVE-2022-0709?
The Booking Package WordPress plugin before version 1.5.29 is affected by CVE-2022-0709.
How can I fix CVE-2022-0709?
To fix CVE-2022-0709, update the Booking Package WordPress plugin to version 1.5.29 or later.
Where can I find more information about CVE-2022-0709?
You can find more information about CVE-2022-0709 at this reference: https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85