cve/2022/CVE-2022-0709.md

### [CVE-2022-0709](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0709)
![](https://img.shields.io/static/v1?label=Product&message=Booking%20Package%20%E2%80%93%20Appointment%20Booking%20Calendar%20System&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=1.5.29%3C%201.5.29%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.

### POC

#### Reference
- https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85
- https://wpscan.com/vulnerability/3cd1d8d2-d2a4-45a9-9b5f-c2a56f08be85

#### Github
- https://github.com/ARPSyndicate/cvemon