CVE-2026-123131
MEDIUM
MEDIUM
Priority: 0.01
BB Relevance:
47/100
Published: 2026-11-09
Modified: 2026-11-10
First seen: 2026-11-09
Status: active
Attack Surface
Network
No Interaction
Integ. Impact
CVSS Vector Breakdown
AV:
Network
AC:
High
PR:
High
UI:
None
S:
Unchanged
C:
None
I:
High
A:
High
Description
The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.
Weakness Classification (1)
Affected Software (2)
| Vendor | Product | Version |
|---|---|---|
| Unknown | GemBooking | 0 < 1.7.1 |
| Unknown | GemBooking | 0 < 1.7.1 |
References & Advisories (1)
exploit
vdb-entry
technical-description