CVE-2026-123131
GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass
CVSS Score
5.9
EPSS Score
0.0%
EPSS Percentile
0th
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
| Vendor | unknown |
| Product | gembooking |
| Published | Nov 9, 2026 |
| Last Updated | Nov 9, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown gembooking
Be the first to know when new medium vulnerabilities affecting unknown gembooking are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / GemBooking
0 < 1.7.1
References
Credits
c0redumpsec WPScan