CVE-2026-123128
LOW
NVD
CVSS Score
3.7
Severity
LOW
Published
Nov 09, 2026
Vendor
unknown
Description
The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.