Read the docs
TI-2026-87000 Aliases CVE-2026-123131

GemBooking plugin lets Staff delete posts and change site settings

Priority LOW 38Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from CNA.

Summary

CVE-2026-123131 affects the GemBooking WordPress plugin before 1.7.1. The plugin does not verify that a REST request targets its own routes before it temporarily grants Staff users administrative capabilities. A user with the Staff role can delete arbitrary posts and update site settings. CISA has not added this issue to its KEV catalog.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

Description from the CNA

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.

Why it matters now

Public exploit Yes 1 exploit referenceTagged by the CNA
Fix Fixed GemBooking (Unknown): 1.7.1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
UnknownGemBookingbefore 1.7.11.7.1Patch availableCNA
  • GemBooking VendorUnknown Affected before 1.7.1 Fixed in 1.7.1 Patch available CNA

Remediation

Update GemBooking to version 1.7.1 or later. The references include a link to exploit details.

Written with Claude Haiku 5.5 from the sources below · 2026-11-09

  • Fix · CNA GemBooking (Unknown) Fixed in 1.7.1

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    GemBooking 1.7.1

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2026-86998 Race condition in GemBooking lets attackers double-book team membersPriority LOW 38
    Show all 2 records →

Timeline

  1. 2026-11-09 Threatist record created from CVE-2026-123131

References

Exploit 1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences