Read the docs
TI-2026-86998 Aliases CVE-2026-123128

Race condition in GemBooking lets attackers double-book team members

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

The GemBooking WordPress plugin before 1.7.1 does not serialize concurrent booking requests per team member. An unauthenticated attacker can send simultaneous requests to create overlapping confirmed bookings for the same team member across different bookable items. A public exploit is linked in the references.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

Why it matters now

Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed GemBooking (Unknown): 1.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownGemBookingbefore 1.7.11.7.1Patch availableCNA
  • GemBooking VendorUnknown Affected before 1.7.1 Fixed in 1.7.1 Patch available CNA

Remediation

Update GemBooking to version 1.7.1, which fixes the flaw.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA GemBooking (Unknown) Fixed in 1.7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GemBooking 1.7.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-87000 GemBooking plugin lets Staff delete posts and change site settingsPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-123128

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences