CVE-2026-123131: GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

Q: Who can exploit this issue?

A user assigned the GemBooking Staff role can exploit it. The issue does not require an unauthenticated attacker, but it allows a staff-level account to gain administrative capabilities during improperly handled REST requests.

Q: What actions could an attacker perform?

An attacker with the GemBooking Staff role could delete arbitrary WordPress posts and modify site settings. This could affect site content and administrative configuration.

Q: Which installations are affected?

Installations using the GemBooking WordPress plugin before version 1.7.1 are affected. The provided information does not identify configuration conditions that would prevent exploitation.

Q: What should be prioritized if an update cannot be applied immediately?

Limit or remove the GemBooking Staff role from accounts that do not require it, since that role is the stated prerequisite for exploitation. Review staff accounts and their assigned roles for unauthorized or unnecessary access.

Published Nov 9, 2026

Updated

The GemBooking WordPress plugin before 1.7.1 does not properly verify that a REST request is addressed to its own routes before temporarily granting staff users administrative capabilities, allowing users with the GemBooking WordPress plugin before 1.7.1's Staff role to delete arbitrary posts and update the site's settings.

Affected Software

1 affected component

GemBooking GemBooking WordPress plugin<1.7.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade GemBooking WordPress plugin to a version that resolves this vulnerability.
Fixed in 1.7.1

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Who can exploit this issue?

A user assigned the GemBooking Staff role can exploit it. The issue does not require an unauthenticated attacker, but it allows a staff-level account to gain administrative capabilities during improperly handled REST requests.

What actions could an attacker perform?

An attacker with the GemBooking Staff role could delete arbitrary WordPress posts and modify site settings. This could affect site content and administrative configuration.

Which installations are affected?

Installations using the GemBooking WordPress plugin before version 1.7.1 are affected. The provided information does not identify configuration conditions that would prevent exploitation.

What should be prioritized if an update cannot be applied immediately?

Limit or remove the GemBooking Staff role from accounts that do not require it, since that role is the stated prerequisite for exploitation. Review staff accounts and their assigned roles for unauthorized or unnecessary access.

CVE-2026-123131: GemBooking < 1.7.1 - Staff+ Arbitrary Post Deletion and Site Settings Update via REST Context Check Bypass

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What actions could an attacker perform?

Which installations are affected?

What should be prioritized if an update cannot be applied immediately?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What actions could an attacker perform?

Which installations are affected?

What should be prioritized if an update cannot be applied immediately?