LOW 3.7 NVD

CVE-2026-123128

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlappi

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

References

https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba/

Published: 2026-11-09 · Source: NVD · Feed updated: 2026-11-10

This low severity vulnerability with a CVSS score of 3.7 was published on 2026-11-09 via NVD.

vulnfeed aggregates 17092 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.