CVE-2026-123128lowCWE-362

CVE-2026-123128: low-severity vulnerability in GemBooking

GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition

Published

Follow this CVE+ Monitor GemBooking

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 3.7epss 0.1%
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
Affected products
Unknown · GemBooking
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GemBooking

In the same product, most dangerous first.

CVE-2026-123131MEDIUMGemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check BypassEPSS 0.2%