{"id":"CVE-2026-119508","kind":"vulnerability","aliases":["CVE-2026-119508"],"related":[],"title":"WordPress Radius Booking plugin: missing authorization check exposes booking access","description":"Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.","summary":"The Radius Booking WordPress plugin, a booking calendar for appointments and services, has a missing authorization check. A user can reach functions they should not be allowed to use because access control is not enforced properly.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","radius-booking","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Radius Booking plugin (radius-booking) is installed on the WordPress site, under Plugins in the admin dashboard.\n- Check the installed plugin version against the affected range: `1.0.20` and earlier.","fix":null,"status":"open","published_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","triaged_at":"2026-11-07T11:48:31+00:00","updated_at":"2026-11-07T11:48:31+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T11:48:31Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Radius Booking plugin: missing authorization check exposes booking access","impact":"medium","summary":"The Radius Booking WordPress plugin, a booking calendar for appointments and services, has a missing authorization check. A user can reach functions they should not be allowed to use because access control is not enforced properly.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","radius-booking","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach booking functions they should not access","analyst_note":"Find the vulnerable function and any fixed version from the Wordfence or plugin changelog; the NVD entry gives no fix version.","how_to_check":"- Check whether the Radius Booking plugin (radius-booking) is installed on the WordPress site, under Plugins in the admin dashboard.\n- Check the installed plugin version against the affected range: `1.0.20` and earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Radius Booking plugin version 1.0.20 or earlier. The sources do not say which functions are exposed or what configuration is required, so unknown whether default settings are affected. Sites that do not use this plugin can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4255,"output_tokens":517,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119508':13A,16A '-2026':12A,15A '1.0.20':97C 'access':10A,55B,81C 'affect':86C 'allow':51B,77C 'appoint':34B,72C,92C 'author':6A,40B,62C 'book':3A,9A,20B,27B,31B,68C,69C,76C,88C,89C 'calendar':32B,70C,90C 'check':7A,41B 'configur':80C 'control':56B,82C 'cve':11A,14A 'enforc':59B 'exploit':78C 'expos':8A 'function':46B 'host':23B 'incorrect':79C 'issu':85C 'levels.this':84C 'mamunur':65C 'miss':5A,39B,61C 'n/a':95C 'packag':17B 'plugin':4A,29B 'proper':60B 'radius':2A,19B,26B,67C,75C,87C 'radius-book':18B,74C 'rashid':66C 'reach':45B 'secur':83C 'self':22B 'self-host':21B 'servic':36B,73C,93C 'use':53B 'user':43B 'vulner':63C 'wordpress':1A,24B,28B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Radius Booking plugin version 1.0.20 or earlier. The sources do not say which functions are exposed or what configuration is required, so unknown whether default settings are affected. Sites that do not use this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","radiusbooking","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-119508':13A,16A '-2026':12A,15A 'access':10A 'author':6A 'book':3A,9A 'check':7A 'cve':11A,14A 'expos':8A 'miss':5A 'plugin':4A 'radius':2A 'wordpress':1A","search_b":"'access':55B 'allow':51B 'appoint':34B 'author':40B 'book':20B,27B,31B 'calendar':32B 'check':41B 'control':56B 'enforc':59B 'function':46B 'host':23B 'miss':39B 'packag':17B 'plugin':29B 'proper':60B 'radius':19B,26B 'radius-book':18B 'reach':45B 'self':22B 'self-host':21B 'servic':36B 'use':53B 'user':43B 'wordpress':24B,28B","search_c":"'1.0.20':97C 'access':81C 'affect':86C 'allow':77C 'appoint':72C,92C 'author':62C 'book':68C,69C,76C,88C,89C 'calendar':70C,90C 'configur':80C 'control':82C 'exploit':78C 'incorrect':79C 'issu':85C 'levels.this':84C 'mamunur':65C 'miss':61C 'n/a':95C 'radius':67C,75C,87C 'radius-book':74C 'rashid':66C 'secur':83C 'servic':73C,93C 'vulner':63C","first_public_at":"2026-11-07T11:16:59+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119508","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119508","severity":null,"published_at":"2026-11-07T11:16:59+00:00","modified_at":"2026-11-07T11:16:59+00:00","first_seen_at":"2026-11-07T11:46:52+00:00","fetched_at":"2026-11-07T11:46:52+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}