The Radius Booking — Booking Calendar for Appointments & Services WordPress plugin contains a deserialization flaw that allows untrusted data to be processed as PHP objects. This vulnerability can be exploited to perform object injection, giving an attacker the ability to execute arbitrary PHP code, modify or delete data, or otherwise tamper with the application. The weakness is classified as CWE-502, a deserialization of untrusted data flaw.

The issue impacts the Radius Booking — Booking Calendar for Appointments & Services plugin from its earliest release up to version 1.0.20. Any WordPress installation using these plugin versions is at risk, regardless of the underlying WordPress core version or host server configuration.

With a CVSS score of 9.8 the vulnerability is high severity and could be used to achieve full control over the affected site. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk if the vulnerability remains unpatched. The likely attack vector is the plugin’s handling of HTTP requests that include serialized input from the web attacker, who can craft payloads that cause the plugin to instantiate malicious objects.