{"id":"CVE-2026-119516","kind":"vulnerability","aliases":["CVE-2026-119516"],"related":[],"title":"WordPress Radius Booking plugin: untrusted data deserialization lets attackers inject objects","description":"Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.","summary":"The Radius Booking WordPress plugin deserializes untrusted input, a flaw known as PHP object injection. An attacker who can reach it may be able to run code or alter data on the site, depending on the classes available.","severity":"critical","cvss":9.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","php","radius-booking","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the `radius-booking` plugin is installed and its version in the WordPress admin plugin list\n- Compare the installed version against `1.0.20`, the last affected version named in the advisory","fix":"- Move the Radius Booking plugin to a version later than `1.0.20`; the sources do not name the exact fixed release","status":"open","published_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","triaged_at":"2026-11-06T08:42:22+00:00","updated_at":"2026-11-06T08:42:22+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T08:42:22Z","model":"claude-haiku-5-5","output":{"fix":"- Move the Radius Booking plugin to a version later than `1.0.20`; the sources do not name the exact fixed release","reach":"internet","title":"WordPress Radius Booking plugin: untrusted data deserialization lets attackers inject objects","impact":"high","summary":"The Radius Booking WordPress plugin deserializes untrusted input, a flaw known as PHP object injection. An attacker who can reach it may be able to run code or alter data on the site, depending on the classes available.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","radius-booking","php"],"confidence":0.6,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Attacker may run code or alter data via object injection","analyst_note":"Check the NVD entry and the plugin's changelog for the fixed version and whether unauthenticated requests reach the vulnerable code.","how_to_check":"- Check whether the `radius-booking` plugin is installed and its version in the WordPress admin plugin list\n- Compare the installed version against `1.0.20`, the last affected version named in the advisory","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are in scope, per the NVD description. The sources do not describe the exact vulnerable endpoint or whether authentication is needed, so the team should check whether the plugin is active on any public site. Sites that do not use this plugin can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4245,"output_tokens":576,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-119516':14A,17A '-2026':13A,16A '1.0.20':95C 'abl':47B 'affect':84C 'allow':80C 'alter':52B 'appoint':75C,90C 'attack':9A,40B 'avail':61B 'book':3A,22B,26B,71C,72C,79C,86C,87C 'calendar':73C,88C 'class':60B 'code':50B 'cve':12A,15A 'data':6A,53B,65C 'depend':57B 'deseri':7A,29B,62C 'flaw':33B 'inject':10A,38B 'injection.this':82C 'input':31B 'issu':83C 'known':34B 'let':8A 'mamunur':68C 'may':45B 'n/a':93C 'object':11A,37B,81C 'packag':18B 'php':19B,36B 'plugin':4A,28B 'radius':2A,21B,25B,70C,78C,85C 'radius-book':20B,77C 'rashid':69C 'reach':43B 'run':49B 'servic':76C,91C 'site':56B 'untrust':5A,30B,64C 'vulner':66C 'wordpress':1A,23B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Radius Booking WordPress plugin at version 1.0.20 or earlier are in scope, per the NVD description. The sources do not describe the exact vulnerable endpoint or whether authentication is needed, so the team should check whether the plugin is active on any public site. Sites that do not use this plugin can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","package","php","radiusbooking","wordpress"],"campaign_type":null,"search_a":"'-119516':14A,17A '-2026':13A,16A 'attack':9A 'book':3A 'cve':12A,15A 'data':6A 'deseri':7A 'inject':10A 'let':8A 'object':11A 'plugin':4A 'radius':2A 'untrust':5A 'wordpress':1A","search_b":"'abl':47B 'alter':52B 'attack':40B 'avail':61B 'book':22B,26B 'class':60B 'code':50B 'data':53B 'depend':57B 'deseri':29B 'flaw':33B 'inject':38B 'input':31B 'known':34B 'may':45B 'object':37B 'packag':18B 'php':19B,36B 'plugin':28B 'radius':21B,25B 'radius-book':20B 'reach':43B 'run':49B 'site':56B 'untrust':30B 'wordpress':23B,27B","search_c":"'1.0.20':95C 'affect':84C 'allow':80C 'appoint':75C,90C 'book':71C,72C,79C,86C,87C 'calendar':73C,88C 'data':65C 'deseri':62C 'injection.this':82C 'issu':83C 'mamunur':68C 'n/a':93C 'object':81C 'radius':70C,78C,85C 'radius-book':77C 'rashid':69C 'servic':76C,91C 'untrust':64C 'vulner':66C","first_public_at":"2026-11-06T08:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119516","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119516","severity":null,"published_at":"2026-11-06T08:17:19+00:00","modified_at":"2026-11-06T08:17:19+00:00","first_seen_at":"2026-11-06T08:40:33+00:00","fetched_at":"2026-11-06T08:40:33+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}