Radius Booking WordPress plugin PHP object injection

A booking site plugin flaw can let attackers take over the site!

Summary

The Radius Booking WordPress booking plugin deserializes untrusted data, letting an attacker inject PHP objects. Versions 1.0.20 and older are affected.

Affected when

WordPress site with the Radius Booking plugin installed
Plugin version 1.0.20 or older

What to do

Update to version 1.0.21 or later.

Products and platforms

Radius Booking — Booking Calendar for Appointments & Services

CVE IDs

CVE-2026-119516 (opens in a new tab)

Sources

CVE record: cve.org (opens in a new tab)

Times

First published 2026-11-06 08:00 UTC

First seen 2026-11-09 17:40 UTC