When a guest make a booking via sending "action: package_app_public_action" and "mode: sendbooking" request (screenshot:, there is a field "icalToken" in the response, screenshot:

If the plugin has ical integration enabled, a threat actor can abuse this feature to download all the booking data, including email and name of all customers.

For example, this file is from demo site and has all the booking information: