CVE-2026-119515 · Package
NO FIX YET
The Radius Booking WordPress plugin, a booking calendar for appointments and services, has a missing authorization check. Per the NVD entry, an attacker can exploit incorrectly configured access control to act beyond their permissions.
first public Nov 9, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are affected. The sources do not say which actions are reachable or which configurations are needed, so the exact exposure is unknown.
Not affected if plugin-not-installed
Who cares radius-booking, wordpress
1.0.20; the sources say versions through 1.0.20 are affectedNo fix yet, per the sources.
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.