RadiusTheme Radius Booking: Unauthenticated SQL injection
Summary
The WordPress plugin Radius Booking (Booking Calendar for Appointments & Services) contains an unauthenticated SQL injection flaw (CWE-89) in versions up to 1.0.19 according to the CVE record; Patchstack lists up to 1.0.20. An attacker can send crafted requests over the network without logging in and read, modify or delete database content, including customer names, contact details and bookings. No fixed version has been confirmed.
Affected
- RadiusTheme Radius Booking (WordPress plugin, Booking Calendar for Appointments & Services)
- Versions up to and including 1.0.19 (CVE record); Patchstack lists up to 1.0.20
- Default configuration: unaffected per CNA record; affected if the plugin is installed in an affected version
Fixed in
Unknown. No vendor security advisory or fixed release has been found. The current wordpress.org version 1.0.19 is still in the affected range.
Workaround
No vendor workaround known. Possible measures:
- Deactivate and remove the plugin if it is not essential
- If it must remain, restrict access to the booking endpoints at web server or WAF level; use a virtual patch only if the WAF vendor provides a rule for this CVE
Exploitation
- Not marked as known exploited; CISA SSVC lists exploitation as none, automatable as yes, technical impact as partial
- No public proof of concept or exploit found, but Patchstack rates it high priority and expects exploitation
- Patchstack has published a mitigation rule to block attacks
Our recommendation
- Check whether the plugin is installed on any WordPress site and which version is running
- If installed and not essential, deactivate and remove it until a fixed release is confirmed
- If it is needed, restrict access to the plugin endpoints and enable a WAF rule or Patchstack mitigation
- Review web server and database logs for unusual requests and signs of data access
- If a compromise is suspected, assess personal data exposure under the Swiss FADP and follow notification duties
- Monitor the Patchstack entry and RadiusTheme's changelog for a fix
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Patchstack advisory (referenced by CVE) patchstack.com
- Strix AI CVE details www.strix.ai
- HOL Guard CVE details hol.org
- WordPress.org plugin page Radius Booking wordpress.org
- WordPress.org plugin page Radius Booking (en-ca) en-ca.wordpress.org
- RadiusTheme Radius Booking downloads www.radiustheme.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 03:21.
Original description (NVD)
Unauthenticated SQL Injection in Radius Booking — Booking Calendar for Appointments & Services <= 1.0.19 versions.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.