CVE-2026-119515: WordPress Radius Booking — Booking Calendar for Appointments & Services plugin <= 1.0.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wordpress/radius-bookingto a version that resolves this vulnerability.Fixed in 1.0.21
Event History
Frequently Asked Questions
Which installations are affected?
The issue affects the Radius Booking — Booking Calendar for Appointments & Services plugin through version 1.0.20. The available data does not identify a fixed version or configuration conditions that would exclude an installation.
Does exploitation require an authenticated WordPress account or user interaction?
No. The supplied CVSS vector indicates network exploitation with low attack complexity, no privileges required, and no user interaction required.
What is the potential impact of successful exploitation?
The supplied severity data rates the issue as medium with a 6.5 CVSS score and indicates low confidentiality and integrity impact. It does not indicate an availability impact.