Critical vulnerability in Radius Booking plugin

WordPress

What happened

There is a critical deserialization vulnerability in the Radius Booking plugin that may allow object injection. This affects versions of the software prior to 1.0.21.

Are you affected?

Users of the Radius Booking — Booking Calendar for Appointments & Services plugin who are running version 1.0.20 or earlier may be affected.

What to do now

1. Upgrade to version 1.0.21 or later.
2. Review your application's security to mitigate potential risks associated with object injection.
3. Consult the official advisory for further information.

Sources

• cve.now/CVE-2026-119516
• CVE-2026-119516
• https://patchstack.com/database/wordpress/plugin/radius-booking/vulnerability/wordpress-radius-booking-booking-calendar-for-appointments-services-plugin-1-0-20-php-object-injection-vulnerability?_s_id=cve
• cve.now/GHSA-g7w9-6f5v-35q7
• GHSA-g7w9-6f5v-35q7
• https://nvd.nist.gov/vuln/detail/CVE-2026-119516

Data sources: cve.now, CISA KEV, GitHub Advisory Database, OSV.

This product uses data from the NVD API but is not endorsed or certified by the NVD.