{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-123128", "assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "state": "PUBLISHED", "assignerShortName": "WPScan", "dateReserved": "2026-11-05T13:13:49.325Z", "datePublished": "2026-11-09T06:00:28.377Z", "dateUpdated": "2026-11-09T14:12:16.368Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81", "shortName": "WPScan", "dateUpdated": "2026-11-09T06:00:28.377Z"}, "title": "GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition", "problemTypes": [{"descriptions": [{"description": "CWE-362 Race Condition (Concurrent Execution using Shared Resource with Improper Synchronization)", "lang": "en", "type": "CWE"}]}], "affected": [{"vendor": "Unknown", "product": "GemBooking", "versions": [{"status": "affected", "versionType": "semver", "version": "0", "lessThan": "1.7.1"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests."}], "references": [{"url": "https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba/", "tags": ["exploit", "vdb-entry", "technical-description"]}], "credits": [{"lang": "en", "value": "Khalid Mostafa Ismail", "type": "finder"}, {"lang": "en", "value": "WPScan", "type": "coordinator"}], "source": {"discovery": "EXTERNAL"}, "x_generator": {"engine": "WPScan CVE Generator"}}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2026-123128", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-09T13:57:18.142517Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-09T14:12:16.368Z"}}]}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "GemBooking", "vendor": "Unknown", "versions": [{"lessThan": "1.7.1", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "contact@wpscan.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests."}], "id": "CVE-2026-123128", "lastModified": "2026-11-09T07:17:29.630", "metrics": {}, "published": "2026-11-09T07:17:29.630", "references": [{"source": "contact@wpscan.com", "url": "https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba/"}], "sourceIdentifier": "contact@wpscan.com", "vulnStatus": "Received"}

{}

{"created": "2026-11-09T08:00:09.228074+00:00", "updated": "2026-11-09T08:00:09.228081+00:00", "vendors": [], "weaknesses": ["CWE-666"]}