The GemBooking WordPress plugin fails to confirm that a REST request is intended for its own routes before temporarily granting staff users administrative privileges. This flaw allows a staff member to delete any post and modify site settings, effectively bypassing role-based restrictions and enabling unauthorized content removal and configuration changes. The vulnerability exposes the site to content loss, potential defacement, and misconfiguration that could be leveraged in further attacks.

Any installation of the GemBooking plugin before version 1.7.1 is affected. The vulnerability is tied to the GemBooking plugin used in WordPress sites where a Staff role exists. Since the product name is listed as Unknown:GemBooking, administrators must confirm they are running a pre‑1.7.1 build of this plugin.

A REST‑based attack vector is implied; the flaw can be triggered by sending crafted HTTP requests to the plugin’s endpoints. While an EPSS score is unavailable and the issue is not listed in the CISA KEV catalog, the capacity to implicitly gain administrative rights and delete content suggests a high-risk scenario. Successful exploitation would grant an attacker full control over the site’s posts and configuration, potentially facilitating broader compromise or defacement.