Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-10
GemBooking - Security Vulnerability (CVE-2026-123131)
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
PLUGIN
GemBooking
CVE-2026-123131
Risk Score
Threat Entry
Updated 2026-11-10
GemBooking - Security Vulnerability (CVE-2026-123128)
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
PLUGIN
GemBooking
CVE-2026-123128
Risk Score