WordPress Plugin Vulnerabilities
GemBooking < 1.7.1 - Unauthenticated Team Member Double-Booking via Cross-Object Race Condition
Description
The plugin does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.
Proof of Concept
Affects Plugins
Fixed in 1.7.1 References
CVE
Classification
Type
RACE CONDITION
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
Khalid Mostafa Ismail
Submitter
Khalid Mostafa Ismail
Submitter twitter
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-11-06 (about 3 days ago)
Added
2026-11-06 (about 2 days ago)
Last Updated
2026-11-06 (about 2 days ago)
