---
id: "CVE-2026-123131"
page: "https://infrastack.ai/live/CVE-2026-123131"
kind: "vulnerability"
aliases: ["CVE-2026-123131"]
title: "GemBooking WordPress plugin lets staff users delete posts and change settings"
severity: "high"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["gembooking", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-gembooking-plugin", "no-staff-users"]
published_at: "2026-11-09T07:17:29+00:00"
first_seen_at: "2026-11-09T07:25:04+00:00"
updated_at: "2026-11-09T07:25:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-123131", "first_seen_at": "2026-11-09T07:25:04+00:00"}]
exploit_sources: []
---

# GemBooking WordPress plugin lets staff users delete posts and change settings

Link for people: https://infrastack.ai/live/CVE-2026-123131 (this .md is for agents)

The GemBooking WordPress plugin before 1.7.1 does not check that a REST request is aimed at its own routes before temporarily giving Staff users administrator capabilities. A user with the Staff role can therefore delete arbitrary posts and change the site's settings.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed GemBooking plugin version in the WordPress admin under Plugins; versions below `1.7.1` are affected.
- Review which accounts hold the Staff role on the site.

## Fix

- GemBooking plugin: move to `1.7.1` or later.

## Timeline

- 2026-11-09T07:25:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-123131

## From the sources

The GemBooking  WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking  WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_