What is GHSA-q8cr-9p4h-4w5w?

GHSA-q8cr-9p4h-4w5w is a security advisory published by GitHub Security Advisories with Low severity. The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per...

Which CVE IDs does GHSA-q8cr-9p4h-4w5w cover?

GHSA-q8cr-9p4h-4w5w covers the following CVE IDs: CVE-2026-123128. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q8cr-9p4h-4w5w?

GHSA-q8cr-9p4h-4w5w has a CVSS v3 base score of 3.7, published by GitHub Security Advisories.

GHSA-q8cr-9p4h-4w5wLowCVSS 3.7

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per...

Vendor

GitHub Security Advisories

Published

November 9, 2026

Last Modified

November 9, 2026

🔗 CVE IDs covered (1)

CVE-2026-123128 →

📋 Description

The GemBooking WordPress plugin before 1.7.1 does not serialise concurrent booking requests per team member, allowing unauthenticated users to create overlapping confirmed bookings for the same team member across different bookable items by sending simultaneous requests.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-123128
https://wpscan.com/vulnerability/e6dd290d-358b-4d03-a585-173d40dee0ba
https://github.com/advisories/GHSA-q8cr-9p4h-4w5w