CVE-2026-119516Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services

WordPress Radius Booking - Booking Calendar for Appointments & Services plugin <= 1.0.20 - PHP Object Injection vulnerability

Not on CISA's list of exploited flaws, and not in the news we track.

SeverityCVSS

9.8of 10, critical

010

Exploited in the wild: Not confirmedBy CISA
Chance of exploitation: Not scored yetEPSS, next 30 days
Used in ransomware: Not known
US federal deadline: None set

Reading the vendor advisory

Fix it in one click

Fix it in your code

Claude Code Codex Cursor Claude Code (web)

Explain it to me

Claude ChatGPT

Each opens with a short prompt that points at Global Hack Map's public runbook for CVE-2026-119516. Nothing runs until you send it.

About this flaw

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking - Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking - Booking Calendar for Appointments & Services: from n/a through 1.0.20.

Published: 6 Nov 2026
Weakness: CWE-502

What should I do about this?

Advisories and references

patchstack.compatchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve