Wordpress Alert: Booking token disclosure

What it looks like

A booking link or token appears in a public response.

Why it matters

Someone else may view or manage a reservation.

What to check

Check token exposure and expiration in the booking plugin.

Documentation

This is an exploit pattern to check in installed components, not a claim that every WordPress site has this flaw. Confirm the product and version against its advisories before treating a site as affected. See WordPress REST endpoint permissions, WordPress roles and capabilities.