CVE-2026-119516 in Radius Booking Plugin
Summary
by MITRE • 11/06/2026
Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 11/06/2026
The identified vulnerability represents a critical security flaw within the Mamunur Rashid Radius Booking plugin, specifically affecting versions ranging from initial release up to version 1.0.20. This issue is classified as an Object Injection resulting from the improper deserialization of untrusted data. In web application architecture, deserialization is the process of converting serialized data back into a usable object structure within memory. When this process occurs without adequate validation or sanitization of the input source, it creates a significant attack vector that can be exploited by malicious actors to compromise the integrity and confidentiality of the underlying system.
The technical root cause lies in the plugin's handling of user-supplied input during the deserialization phase. Instead of restricting the types of objects that can be instantiated or validating the data structure against an expected schema, the application accepts arbitrary serialized payloads from untrusted sources. This lack of strict type checking allows attackers to craft malicious serialized strings containing dangerous PHP classes and methods. When the vulnerable code executes these inputs, it instantiates the specified objects with attacker-controlled properties, effectively bypassing standard security controls that rely on object state integrity.
This vulnerability aligns closely with Common Weakness Enumeration (CWE) identifiers such as CWE-502 Deserialization of Untrusted Data and CWE-913 Improper Control of Dynamically-Managed Code Resources. From a tactical perspective, this flaw facilitates the ATT&CK technique T1190 Exploit Public-Facing Application, allowing adversaries to leverage publicly accessible interfaces for initial access or further exploitation. The ability to inject objects means that an attacker can manipulate internal application logic, potentially leading to remote code execution if dangerous classes with magic methods like __wakeup are present in the environment.
The operational impact of this vulnerability is severe and multifaceted. Successful exploitation could allow a low-privileged user, such as a subscriber or even an unauthenticated visitor depending on the specific endpoint exposed, to execute arbitrary commands on the server hosting the WordPress instance. This can lead to complete system compromise, including data exfiltration, installation of webshells for persistent access, and lateral movement within the network infrastructure. Furthermore, it undermines the trust model of the application, as administrative functions or sensitive booking data could be manipulated or deleted by unauthorized parties.
Mitigation strategies must focus on immediate remediation through software updates and architectural hardening. The primary defense is to upgrade Radius Booking — Booking Calendar for Appointments & Services to a version later than 1.0.20 where the vendor has presumably addressed this deserialization flaw. In scenarios where an update cannot be immediately applied, administrators should implement strict input validation on all parameters passed to serialization functions and avoid using native PHP unserialization methods like unserialize() with user-controlled data entirely. Instead, safer alternatives such as JSON encoding and decoding should be utilized for data exchange whenever possible. Additionally, enabling comprehensive logging and monitoring can help detect attempts to exploit this vulnerability by identifying anomalous patterns in request payloads targeting the plugin's endpoints.