CVE-2026-123128 PUBLISHED

GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition

Assigner: WPScan
Reserved: 05.11.2026 Published: 09.11.2026 Updated: 09.11.2026

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

Product Status

Vendor Unknown
Product GemBooking
Versions Default: unaffected
  • affected from 0 to 1.7.1 (excl.)

Credits

  • Khalid Mostafa Ismail finder
  • WPScan coordinator

References

Problem Types

  • CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization) CWE