{"id":"CVE-2026-123128","kind":"vulnerability","aliases":["CVE-2026-123128"],"related":[],"title":"GemBooking WordPress plugin: concurrent requests create overlapping confirmed bookings","description":"The GemBooking  WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.","summary":"The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests for the same team member. An unauthenticated visitor sending simultaneous requests can get overlapping confirmed bookings for one team member across different bookable items.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"GemBooking","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["booking-sites","gembooking","package","wordpress"],"not_affected_if":["plugin-at-1.7.1-or-later","plugin-not-installed"],"how_to_check":"- Check the installed GemBooking plugin version in the WordPress admin Plugins screen, or in the plugin's main file header.\n- Look for double-booked team members in the booking calendar or reservation list.","fix":"- GemBooking plugin: move to `1.7.1` or later.","status":"open","published_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:37+00:00","updated_at":"2026-11-09T07:25:37+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:37Z","model":"claude-haiku-5-5","output":{"fix":"- GemBooking plugin: move to `1.7.1` or later.","reach":"internet","title":"GemBooking WordPress plugin: concurrent requests create overlapping confirmed bookings","impact":"low","summary":"The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests for the same team member. An unauthenticated visitor sending simultaneous requests can get overlapping confirmed bookings for one team member across different bookable items.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gembooking","booking-sites"],"confidence":0.6,"fix_status":"available","needs_auth":"no","worst_case":"Overlapping confirmed bookings for the same team member","analyst_note":"","how_to_check":"- Check the installed GemBooking plugin version in the WordPress admin Plugins screen, or in the plugin's main file header.\n- Look for double-booked team members in the booking calendar or reservation list.","plain_action":"","product_name":"GemBooking","needs_analyst":false,"not_affected_if":["plugin-at-1.7.1-or-later","plugin-not-installed"],"who_is_affected":"Sites running the GemBooking WordPress plugin before 1.7.1 that take bookings for team members. The risk is double-booking, not code execution. Sites without this plugin or already on 1.7.1 or later are not affected.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000722,"input_tokens":4531,"output_tokens":537,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123128':12A,15A '-2026':11A,14A '1.7.1':28B,64C 'across':55B,87C 'allow':74C 'book':9A,18B,33B,50B,69C,81C 'bookabl':57B,89C 'booking-sit':17B 'concurr':4A,32B,68C 'confirm':8A,49B,80C 'creat':6A,78C 'cve':10A,13A 'differ':56B,88C 'gembook':1A,20B,24B,60C 'gembooking':16A 'get':47B 'item':58B,90C 'member':39B,54B,73C,86C 'one':52B 'overlap':7A,48B,79C 'packag':21B 'per':71C 'plugin':3A,26B,62C 'request':5A,34B,45B,70C,94C 'send':43B,92C 'serialis':31B,67C 'simultan':44B,93C 'site':19B 'team':38B,53B,72C,85C 'unauthent':41B,75C 'user':76C 'visitor':42B 'wordpress':2A,22B,25B,61C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GemBooking WordPress plugin before 1.7.1 that take bookings for team members. The risk is double-booking, not code execution. Sites without this plugin or already on 1.7.1 or later are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["gembooking"],"ptokens":["gembooking"],"labels":["bookingsites","gembooking","medium","package","vendor","wordpress"],"campaign_type":null,"search_a":"'-123128':12A,15A '-2026':11A,14A 'book':9A 'concurr':4A 'confirm':8A 'creat':6A 'cve':10A,13A 'gembook':1A 'gembooking':16A 'overlap':7A 'plugin':3A 'request':5A 'wordpress':2A","search_b":"'1.7.1':28B 'across':55B 'book':18B,33B,50B 'bookabl':57B 'booking-sit':17B 'concurr':32B 'confirm':49B 'differ':56B 'gembook':20B,24B 'get':47B 'item':58B 'member':39B,54B 'one':52B 'overlap':48B 'packag':21B 'plugin':26B 'request':34B,45B 'send':43B 'serialis':31B 'simultan':44B 'site':19B 'team':38B,53B 'unauthent':41B 'visitor':42B 'wordpress':22B,25B","search_c":"'1.7.1':64C 'across':87C 'allow':74C 'book':69C,81C 'bookabl':89C 'concurr':68C 'confirm':80C 'creat':78C 'differ':88C 'gembook':60C 'item':90C 'member':73C,86C 'overlap':79C 'per':71C 'plugin':62C 'request':70C,94C 'send':92C 'serialis':67C 'simultan':93C 'team':72C,85C 'unauthent':75C 'user':76C 'wordpress':61C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123128","severity":null,"published_at":"2026-11-09T07:17:29+00:00","modified_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}