CVE-2026-123131mediumCWE-863

CVE-2026-123131: medium-severity vulnerability in GemBooking

GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

Published

Follow this CVE+ Monitor GemBooking

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

33Vexday Risk Score

No sign of exploitation. It has a public proof of concept.

ssvc Attendcvss 5.9epss 0.2%
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:H/A:H
Affected products
Unknown · GemBooking
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — GemBooking

In the same product, most dangerous first.

CVE-2026-123128LOWGemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race ConditionEPSS 0.1%