{"id":"CVE-2026-123131","kind":"vulnerability","aliases":["CVE-2026-123131"],"related":[],"title":"GemBooking WordPress plugin lets staff users delete posts and change settings","description":"The GemBooking  WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking  WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.","summary":"The GemBooking WordPress plugin before 1.7.1 does not check that a REST request is aimed at its own routes before temporarily giving Staff users administrator capabilities. A user with the Staff role can therefore delete arbitrary posts and change the site's settings.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["gembooking","package","self-hosted","wordpress"],"not_affected_if":["no-gembooking-plugin","no-staff-users"],"how_to_check":"- Check the installed GemBooking plugin version in the WordPress admin under Plugins; versions below `1.7.1` are affected.\n- Review which accounts hold the Staff role on the site.","fix":"- GemBooking plugin: move to `1.7.1` or later.","status":"open","published_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","triaged_at":"2026-11-09T07:25:36+00:00","updated_at":"2026-11-09T07:25:36+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-09T07:25:36Z","model":"claude-haiku-5-5","output":{"fix":"- GemBooking plugin: move to `1.7.1` or later.","reach":"network","title":"GemBooking WordPress plugin lets staff users delete posts and change settings","impact":"medium","summary":"The GemBooking WordPress plugin before 1.7.1 does not check that a REST request is aimed at its own routes before temporarily giving Staff users administrator capabilities. A user with the Staff role can therefore delete arbitrary posts and change the site's settings.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","gembooking","self-hosted"],"confidence":0.6,"fix_status":"available","needs_auth":"yes","worst_case":"Staff user deletes arbitrary posts and changes site settings","analyst_note":"","how_to_check":"- Check the installed GemBooking plugin version in the WordPress admin under Plugins; versions below `1.7.1` are affected.\n- Review which accounts hold the Staff role on the site.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-gembooking-plugin","no-staff-users"],"who_is_affected":"Sites running the GemBooking WordPress plugin before 1.7.1 that have users with the Staff role. Sites without GemBooking or with no Staff users are not exposed by this description.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4557,"output_tokens":506,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-123131':14A,17A '-2026':13A,16A '1.7.1':29B,72C,102C 'address':82C 'administr':48B,92C 'aim':38B 'allow':94C 'arbitrari':59B,108C 'capabl':49B,93C 'chang':10A,62B 'check':32B 'cve':12A,15A 'delet':7A,58B,107C 'gembook':1A,18B,25B,68C,98C 'give':45B 'grant':89C 'host':22B 'let':4A 'packag':19B 'plugin':3A,27B,70C,100C 'post':8A,60B,109C 'proper':75C 'request':36B,80C 'rest':35B,79C 'role':55B,105C 'rout':42B,86C 'self':21B 'self-host':20B 'set':11A,66B,115C 'site':64B,113C 'staff':5A,46B,54B,90C,104C 'temporarili':44B,88C 'therefor':57B 'updat':111C 'user':6A,47B,51B,91C,95C 'verifi':76C 'wordpress':2A,23B,26B,69C,99C","nicknames":[],"mitigations":[],"who_affected":"Sites running the GemBooking WordPress plugin before 1.7.1 that have users with the Staff role. Sites without GemBooking or with no Staff users are not exposed by this description.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["gembooking","high","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-123131':14A,17A '-2026':13A,16A 'chang':10A 'cve':12A,15A 'delet':7A 'gembook':1A 'let':4A 'plugin':3A 'post':8A 'set':11A 'staff':5A 'user':6A 'wordpress':2A","search_b":"'1.7.1':29B 'administr':48B 'aim':38B 'arbitrari':59B 'capabl':49B 'chang':62B 'check':32B 'delet':58B 'gembook':18B,25B 'give':45B 'host':22B 'packag':19B 'plugin':27B 'post':60B 'request':36B 'rest':35B 'role':55B 'rout':42B 'self':21B 'self-host':20B 'set':66B 'site':64B 'staff':46B,54B 'temporarili':44B 'therefor':57B 'user':47B,51B 'wordpress':23B,26B","search_c":"'1.7.1':72C,102C 'address':82C 'administr':92C 'allow':94C 'arbitrari':108C 'capabl':93C 'delet':107C 'gembook':68C,98C 'grant':89C 'plugin':70C,100C 'post':109C 'proper':75C 'request':80C 'rest':79C 'role':105C 'rout':86C 'set':115C 'site':113C 'staff':90C,104C 'temporarili':88C 'updat':111C 'user':91C,95C 'verifi':76C 'wordpress':69C,99C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T07:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-123131","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-123131","severity":null,"published_at":"2026-11-09T07:17:29+00:00","modified_at":"2026-11-09T07:17:29+00:00","first_seen_at":"2026-11-09T07:25:04+00:00","fetched_at":"2026-11-09T07:25:04+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}