CVE-2026-119516 · Package
NO FIX YET · SEE WHAT TO DO
The Radius Booking WordPress plugin deserializes untrusted input, a flaw known as PHP object injection. An attacker who can reach it may be able to run code or alter data on the site, depending on the classes available.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are in scope, per the NVD description. The sources do not describe the exact vulnerable endpoint or whether authentication is needed, so the team should check whether the plugin is active on any public site. Sites that do not use this plugin can skip it.
Not affected if plugin-not-installed
Who cares php, radius-booking, wordpress
radius-booking plugin is installed and its version in the WordPress admin plugin list1.0.20, the last affected version named in the advisory1.0.20; the sources do not name the exact fixed releaseDeserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.