title: Booking Package < 1.5.29 - Unauthenticated Sensitive Data Disclosure
description: The Booking Package WordPress plugin before 1.5.29 requires a token for exporting the ical representation of it's booking calendar, but this token is returned in the json response to unauthenticated users performing a booking, leading to a sensitive data disclosure vulnerability.
problem types: CWE-200 Information Exposure
affected:
{
product: Booking Package – Appointment Booking Calendar System
vendor: Unknown
versions:
lessThan: 1.5.29, status: affected, version: 1.5.29, versionType: custom
}