CVE-2026-119516: Object Injection in Radius Booking

Critical deserialization (CVSS 9.8) in Radius Booking: Object Injection. Versions up to 1.0.20. Check and patch.

CVE-2026-119516 is a Deserialization of Untrusted Data vulnerability affecting Radius Booking — Booking Calendar for Appointments & Services plugin, used to manage online bookings and appointments. The flaw allows Object Injection impacting plugin instances up to version 1.0.20.

The vulnerability is rated CVSS 9.8 (critical). CVE-2026-119516 was published on NVD on November 6, 2026; currently, no exploits are reported in public GitHub repositories. However, awareness signals from X (2 posts within 24 hours) suggest the security community has already identified the flaw as a priority.

Verify immediately which version of Radius Booking is installed. If running versions up to 1.0.20, monitor official plugin channels for patch availability. In the interim, segment access to the plugin, deploy WAF to validate input data, and reduce the attack surface exposure of your booking system.

At a glance

What: Deserialization of Untrusted Data allows Object Injection in Radius Booking — Booking Calendar for Appointments & Services plugin
Severity: CVSS 9.8 (critical)
Affected versions: Radius Booking up to version 1.0.20
Fix: Not reported – monitor official plugin channels
Status: Published on NVD November 6, 2026. No exploits reported on GitHub. Awareness signaled on X (2 posts in 24 hours).
Action: Verify Radius Booking version, limit plugin exposure, deploy WAF, validate input, monitor official patch

Sources: NVD, CVE-2026-119516

← All articles