External risk intelligence

Radius Booking Object Injection Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2026-119516

This vulnerability affects a WordPress plugin designed for booking appointments and services. Such plugins are typically installed on web servers to provide public-facing web interfaces, booking forms, and calendar services accessible to customers over the internet.

Deserialization

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in the Radius Booking plugin for WordPress, specifically affecting its appointment and services calendar. This issue involves the handling of untrusted data, which could allow malicious actors to inject and execute arbitrary code, potentially impacting the integrity and availability of systems using this plugin. The main concern at this time is confirming if this plugin is in use and, if so, understanding the extent of exposure.

Plugin allows code injection via untrusted data.
Critical vulnerability with potential for significant system impact.
Confirm relevance and exposure of the booking plugin.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted data to the Radius Booking plugin through its network-accessible interface. This data would then be deserialized without proper validation, allowing the attacker to inject malicious objects into the application. Successful exploitation could lead to the attacker gaining complete control over the affected system.

Unauthenticated access to the plugin.
Sending malicious serialized data.
Full system compromise.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unauthenticated attacker to inject malicious objects into the Radius Booking plugin when processing untrusted data. This could lead to the execution of arbitrary code on the server when supported by the advisory.

Plugin data and server-side code.
Via unsanitized user input processing.
Potential for code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This critical deserialization vulnerability in the Radius Booking plugin likely requires action from the application owner or platform team responsible for the WordPress site, in coordination with the security team. The first practical step is to identify all instances of the Radius Booking plugin, confirm its exposure to the internet, and assess its business criticality to prioritize remediation efforts.

Application owner owns the issue.
Verify plugin presence and internet exposure.
Plan vendor-coordinated remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Radius Booking plugin?

Radius Booking is a WordPress plugin used by websites to manage appointments and services. It provides functional tools like booking forms and calendar displays that allow customers to schedule time slots directly through a site's web interface.

What does deserialization of untrusted data mean for CVE-2026-119516?

This refers to a weakness classified as CWE-502, where the application takes data from an external source and transforms it back into an object without checking if it is safe. Because the software trusts this input, an attacker can use it to inject malicious objects, potentially tricking the system into running unauthorized code.

How can an attacker trigger this vulnerability?

An attacker triggers this by sending specifically crafted, malicious data to the plugin's network interface. It is important to note that simply viewing a calendar or browsing the site typically does not trigger the bug; the system must process the malformed input through the plugin's data-handling functions.

Why should I be concerned if my site uses Radius Booking?

Halo Surface Signal indicates that because this plugin is designed to provide public-facing booking forms and calendars, it is often exposed directly to the internet. Since this vulnerability does not require authentication to exploit, any site running the affected plugin is potentially reachable by remote actors.

What should I do if I have Radius Booking installed?

Your first step is to confirm whether the plugin is active on your WordPress environment and assess how critical it is to your current business operations. Once identified, coordinate with your site administrators to plan for potential updates or temporary removal until a secure version is available.

References

patchstack.com/database/wordpress/plugin/radius-booking/vulnerabilit…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.