Security notice
Take bookings on WordPress with Radius Booking? A flaw rated 9.8 is fixed in 1.0.21. Update today.
Radius Booking - Booking Calendar for Appointments & Services versions 1.0.20 and earlier have CVE-2026-119516, an unauthenticated PHP object injection flaw. Someone without a login can manipulate how the plugin processes data. Patchstack describes the risk as harmful actions on the server; it calls the flaw PHP object injection. Update to 1.0.21 or later today. If you cannot update, deactivate the plugin until you can. (Patchstack, CVE record)
What happened
- The flaw. CVE-2026-119516 affects Radius Booking - Booking Calendar for Appointments & Services through 1.0.20. Someone without a login can manipulate how the plugin processes data. Patchstack describes the risk as harmful actions on the server; it calls the flaw PHP object injection. (Patchstack, CVE record)
- The fix. Patchstack lists 1.0.21 as the patched version. Update to that version or later. (Patchstack)
- Severity. CVSS 9.8 (Patchstack). Patchstack calls it high priority and expected to become exploited. That is a risk warning, not confirmation that a particular site was attacked. (Patchstack, CVE record)
Who should worry
This applies to the Radius Booking - Booking Calendar for Appointments & Services plugin, WordPress.org slug radius-booking, at 1.0.20 or earlier. (CVE record)
WordPress.org lists 500+ active installations. That is a plugin installation count, not a count of affected or compromised sites. (WordPress.org)
What to do now
- Update to 1.0.21 or later today. Back up the site and database first, then update the plugin through WordPress. (Patchstack)
- If the update has to wait, deactivate the plugin until you can install the fixed version. Check which forms or login features this pauses before leaving the site unattended.
- Check accounts and files. After updating, test your public booking form and review recent administrator and plugin changes. Ask your developer to investigate anything you do not recognize. Updating closes the flaw; it does not undo access an attacker may already have gained.
- Test the site. Check the pages that use this plugin after updating.
WordPress.org currently lists 1.0.22. Prefer that or a later release; 1.0.21 is the minimum fix for this CVE.
What to send your developer, agency or host
Please check whether our WordPress site runs Radius Booking - Booking Calendar for Appointments & Services. CVE-2026-119516 affects versions 1.0.20 and earlier; it is an unauthenticated PHP object injection flaw, fixed in 1.0.21+. This applies to the Radius Booking - Booking Calendar for Appointments & Services plugin, WordPress.org slug radius-booking, at 1.0.20 or earlier. Please update today, or deactivate until the update can be installed. After updating, test your public booking form and review recent administrator and plugin changes. Ask your developer to investigate anything you do not recognize. Please confirm the version you left us on. Sources: Patchstack, CVE record.
Common questions
Does this mean my site was hacked?
No. A vulnerable version is a reason to update and review the site, not proof of a break-in.
Can EverThread tell me if I am affected?
No. EverThread does not test for this. We cannot see which WordPress plugins your site runs or which versions they are on. A scan without a warning about this plugin does not mean your site is safe.
Where can I follow updates?
Follow Patchstack, the CVE record and the plugin page on WordPress.org. All current notices are on our notices page.
Security alerts by email
Hear about the next one first.
When a flaw puts websites at risk, we send one email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.
Sources
- Patchstack: CVE-2026-119516, affected through 1.0.20, fixed in 1.0.21, published November 4, 2026.
- CVE record: CVE-2026-119516. Patchstack-assigned record.
- WordPress.org: plugin version information and 500+ active installations.