{"affected":[{"defaultStatus":"unaffected","product":"GemBooking","source":"CNA: WPScan","vendor":"Unknown","versions":[{"lessThan":"1.7.1","status":"affected","version":"0","versionType":"semver"}]}],"cveId":"CVE-2026-123128","cwes":["CWE-362"],"description":"The GemBooking  WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.","epss":null,"exploits":[{"kind":"exploit","source":"CNA: WPScan","url":"https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba/"}],"kev":null,"metrics":[],"modifiedAt":1794204028377,"publishedAt":1794204028377,"references":[{"source":"CNA: WPScan","tags":["exploit","vdb-entry","technical-description"],"url":"https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba/"}],"remediation":[],"revision":"2f0fc097d13d63f1a844a3d0172382ea66c32a6648f05e1e88c55941c735131e","sources":[{"modifiedAt":1794204028377,"name":"CNA: WPScan","retrievedAt":1794208127522,"url":"https://www.cve.org/CVERecord?id=CVE-2026-123128"}],"ssvc":null,"status":"published","title":"GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition","updatedAt":1794208127522}