CVE-2026-123128
GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition
CVSS Score
3.7
EPSS Score
0.0%
EPSS Percentile
0th
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
| Vendor | unknown |
| Product | gembooking |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gembooking
Be the first to know when new low vulnerabilities affecting unknown gembooking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / GemBooking
0 < 1.7.1
References
Credits
Khalid Mostafa Ismail WPScan