EUVD-2026-119833

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and...

EUVD-2026-119831

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests...

CVE-2026-123128

The GemBooking WordPress plugin (versions prior to 1.7.1 ) is vulnerable to an unauthenticated team member double-booking due to a cross-object race condition . The software fails to serialize concurrent booking requests per team member, which allows an unauthenticated user to create overlapping ...

CVE-2026-123131

The GemBooking WordPress plugin versions prior to 1.7.1 is vulnerable to a REST context check bypass . The software fails to properly verify that a REST request is intended for its specific routes before granting temporary administrative capabilities to users with the Staff role. This flaw allows...