Unauthenticated SQL Injection in Radius Booking Plugin by WordPress
CVE-2026-39764

9.3CRITICAL

Key Information:

Vendor

WordPress
Status
Radius Booking — Booking Calendar For Appointments & Services
Vendor
CVE Published:
6 October 2026

What is CVE-2026-39764?

An unauthenticated SQL injection vulnerability exists in the Radius Booking plugin for WordPress, specifically affecting versions 1.0.19 and earlier. This flaw may allow attackers to manipulate SQL queries and potentially access sensitive data without any user authentication, posing significant security risks to websites utilizing this plugin.

Affected Version(s)

Radius Booking — Booking Calendar for Appointments &amp; Services <= 1.0.19

References

https://patchstack.com/database/wordpress/plugin/radius-b...
vdb-entry

CVSS V3.1

Score:
9.3
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Pedro "TheZakMan" Araujo | Patchstack Bug Bounty Program
.