Improper Authorization in GemBooking WordPress Plugin by Limesurvey
CVE-2026-123131
Currently unrated
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 9 November 2026
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-123131?
The GemBooking plugin for WordPress, prior to version 1.7.1, is vulnerable due to inadequate verification of REST requests, potentially allowing users with the 'Staff' role to temporarily gain administrative privileges. This flaw can be exploited to delete arbitrary posts and alter critical site settings, presenting significant risks to site integrity and security.
Affected Version(s)
GemBooking 0 < 1.7.1
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.