CVE-2026-123128

GemBooking double-booking of team members in booking requests

low · 3.7

Fix listed

GemBooking

Published Nov 9, 2026, 06:00 UTC

Description

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

Reported fixed versions

1.7.1

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.