---
id: "CVE-2026-123128"
page: "https://infrastack.ai/live/CVE-2026-123128"
kind: "vulnerability"
aliases: ["CVE-2026-123128"]
title: "GemBooking WordPress plugin: concurrent requests create overlapping confirmed bookings"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "GemBooking", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["booking-sites", "gembooking", "package", "wordpress"]
not_affected_if: ["plugin-at-1.7.1-or-later", "plugin-not-installed"]
published_at: "2026-11-09T07:17:29+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:25:37+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123128", "first_seen_at": "2026-11-09T07:25:04+00:00"}]
exploit_sources: []
---

# GemBooking WordPress plugin: concurrent requests create overlapping confirmed bookings

Link for people: https://infrastack.ai/live/CVE-2026-123128 (this .md is for agents)

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests for the same team member. An unauthenticated visitor sending simultaneous requests can get overlapping confirmed bookings for one team member across different bookable items.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:GemBooking affected range not listed fixed no fixed version listed

## How to check

- Check the installed GemBooking plugin version in the WordPress admin Plugins screen, or in the plugin's main file header.
- Look for double-booked team members in the booking calendar or reservation list.

## Fix

- GemBooking plugin: move to `1.7.1` or later.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123128

## From the sources

The GemBooking  WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_