{"id":"CVE-2026-119515","kind":"vulnerability","aliases":["CVE-2026-119515"],"related":[],"title":"WordPress Radius Booking plugin: missing authorization check exposes booking data","description":"Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.","summary":"The Radius Booking WordPress plugin, a booking calendar for appointments and services, has a missing authorization check. Per the NVD entry, an attacker can exploit incorrectly configured access control to act beyond their permissions.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","radius-booking","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the Radius Booking plugin (Booking Calendar for Appointments & Services) is installed on the WordPress site\n- Check the installed plugin version against `1.0.20`; the sources say versions through `1.0.20` are affected","fix":null,"status":"open","published_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","triaged_at":"2026-11-09T11:26:47+00:00","updated_at":"2026-11-09T11:26:47+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-09T11:26:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Radius Booking plugin: missing authorization check exposes booking data","impact":"medium","summary":"The Radius Booking WordPress plugin, a booking calendar for appointments and services, has a missing authorization check. Per the NVD entry, an attacker can exploit incorrectly configured access control to act beyond their permissions.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","radius-booking"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unknown access control bypass on booking data","analyst_note":"Confirm the affected function, required auth, and a fixed version from the plugin's WordPress.org page or the Wordfence/NVD record.","how_to_check":"- Check whether the Radius Booking plugin (Booking Calendar for Appointments & Services) is installed on the WordPress site\n- Check the installed plugin version against `1.0.20`; the sources say versions through `1.0.20` are affected","plain_action":"","product_name":"Radius Booking — Booking Calendar for Appointments & Services","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are affected. The sources do not say which actions are reachable or which configurations are needed, so the exact exposure is unknown.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000737,"input_tokens":4583,"output_tokens":557,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119515':13A,16A '-2026':12A,15A '1.0.20':92C 'access':49B,76C 'act':52B 'affect':81C 'allow':72C 'appoint':31B,67C,87C 'attack':44B 'author':6A,37B,57C 'beyond':53B 'book':3A,9A,20B,24B,28B,63C,64C,71C,83C,84C 'calendar':29B,65C,85C 'check':7A,38B 'configur':48B,75C 'control':50B,77C 'cve':11A,14A 'data':10A 'entri':42B 'exploit':46B,73C 'expos':8A 'incorrect':47B,74C 'issu':80C 'levels.this':79C 'mamunur':60C 'miss':5A,36B,56C 'n/a':90C 'nvd':41B 'packag':17B 'per':39B 'permiss':55B 'plugin':4A,26B 'radius':2A,19B,23B,62C,70C,82C 'radius-book':18B,69C 'rashid':61C 'secur':78C 'servic':33B,68C,88C 'vulner':58C 'wordpress':1A,21B,25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are affected. The sources do not say which actions are reachable or which configurations are needed, so the exact exposure is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","radiusbooking","wordpress"],"campaign_type":null,"search_a":"'-119515':13A,16A '-2026':12A,15A 'author':6A 'book':3A,9A 'check':7A 'cve':11A,14A 'data':10A 'expos':8A 'miss':5A 'plugin':4A 'radius':2A 'wordpress':1A","search_b":"'access':49B 'act':52B 'appoint':31B 'attack':44B 'author':37B 'beyond':53B 'book':20B,24B,28B 'calendar':29B 'check':38B 'configur':48B 'control':50B 'entri':42B 'exploit':46B 'incorrect':47B 'miss':36B 'nvd':41B 'packag':17B 'per':39B 'permiss':55B 'plugin':26B 'radius':19B,23B 'radius-book':18B 'servic':33B 'wordpress':21B,25B","search_c":"'1.0.20':92C 'access':76C 'affect':81C 'allow':72C 'appoint':67C,87C 'author':57C 'book':63C,64C,71C,83C,84C 'calendar':65C,85C 'configur':75C 'control':77C 'exploit':73C 'incorrect':74C 'issu':80C 'levels.this':79C 'mamunur':60C 'miss':56C 'n/a':90C 'radius':62C,70C,82C 'radius-book':69C 'rashid':61C 'secur':78C 'servic':68C,88C 'vulner':58C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T11:17:21+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119515","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119515","severity":null,"published_at":"2026-11-09T11:17:21+00:00","modified_at":"2026-11-09T11:17:21+00:00","first_seen_at":"2026-11-09T11:26:03+00:00","fetched_at":"2026-11-09T11:26:03+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}