Description

Deserialization of Untrusted Data vulnerability in Mamunur Rashid Radius Booking — Booking Calendar for Appointments & Services radius-booking allows Object Injection.This issue affects Radius Booking — Booking Calendar for Appointments & Services: from n/a through 1.0.20.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-11-06T08:17:19.227Z",
  "pubdate": "2026-11-06T08:17:19.227Z",
  "executiveSummary": "The Radius Booking — Booking Calendar for Appointments & Services plugin for WordPress is susceptible to a Deserialization of Untrusted Data vulnerability, specifically classified as Object Injection.\nThis vulnerability exists within versions n/a through 1.0.20 of the product.\nThe flaw allows an unauthenticated or authenticated attacker to inject malicious serialized objects into the application, which are then processed by the underlying PHP application.\nSuccessful exploitation of this vulnerability enables arbitrary code execution or unauthorized manipulation of application state by leveraging existing classes within the application or its environment (POP chains).\nThe impact is critical, as it may lead to a complete site compromise, data exfiltration, or denial-of-service conditions depending on the available gadget chains within the application's codebase.\nUsers are strongly advised to update to a patched version once available or remove the plugin if a secure version cannot be verified.",
  "technicalDetails": "The vulnerability is rooted in the improper handling of untrusted user input within the Radius Booking plugin. Specifically, the application uses PHP's unserialize() function on data sourced from user-controllable inputs without implementing adequate validation or filtering mechanisms.\nObject Injection occurs when an application deserializes untrusted data into a PHP object. If the application environment contains 'gadget' classes—existing code in the plugin, WordPress core, or other installed themes/plugins—an attacker can craft a malicious serialized payload that, when unserialized, triggers unintended behavior in these gadget classes.\nThe exploitation flow typically involves the following stages: 1) Identification of an input vector that passes serialized data to a vulnerable unserialize() call within the plugin. 2) Crafting of a payload containing a serialized object structure that leverages existing classes (POP chains) to achieve a malicious objective, such as writing arbitrary files, executing system commands, or modifying database entries. 3) Submission of the crafted payload to the vulnerable endpoint via HTTP GET or POST request. 4) The application processes the deserialization, instantiating the attacker's defined object state and invoking magic methods (e.g., __destruct(), __wakeup(), __toString()) within the gadget chain.\nBecause PHP's unserialize() can instantiate any class that has been declared in the scope of the application at the time of execution, the attacker has a broad attack surface to manipulate the application's runtime state. The impact is not limited to the plugin itself; the presence of common gadget chains within the broader WordPress ecosystem significantly increases the feasibility and severity of the exploit.\nThe vulnerability affects all versions of Radius Booking — Booking Calendar for Appointments & Services from n/a through 1.0.20. It requires no specific privileges for the initial injection if the vulnerable entry point is accessible to unauthenticated users, which is common in public-facing plugin endpoints. The persistence of the exploit is guaranteed by the immediate execution of magic methods upon the destruction or manipulation of the injected object, allowing for post-exploitation activities such as installing web shells or escalating privileges within the WordPress environment."
}