Radius Booking EUVD-2026-93271

No special configuration conditions are stated in the advisory: the flaw is reachable by unauthenticated remote attackers (AV:N/PR:N/UI:N) against installations of the Radius Booking - Booking Calendar for Appointments & Services plugin at version 1.0.19 or earlier. The primary limiting factor is deployment scope - the target WordPress site must have this specific plugin installed and active at a vulnerable version; sites on 1.0.20+ (or without the plugin) are not exposed. No authentication, user interaction, or non-default setting is required to reach the vulnerable code path based on available data.

This is a credible high-priority issue for affected WordPress sites, driven primarily by the attack-surface profile rather than confirmed exploitation. The CVSS vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity, unauthenticated exploitation with no user interaction - the worst-case access profile for a web application flaw, consistent with CWE-89 SQL injection. The 9.3 base score is materially inflated by the S:C (scope change) and A:L assignment from Patchstack; a conventional unauthenticated read-oriented SQLi would typically score ~7.5 (S:U). No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active or at-scale exploitation yet. The signals therefore align on 'easy to exploit if present' but provide no exploitation-prevalence data: treat as a priority patch for sites running the plugin, but note that absence of KEV/EPSS/POC means real-world weaponization is currently unconfirmed. The I:N / C:H combination implies data disclosure without integrity impact (read-only injection) - verify against the vendor advisory, as many SQLi flaws also permit data modification.

A remote, unauthenticated attacker sends a crafted HTTP request to a vulnerable Radius Booking endpoint (e.g. a booking or appointment-lookup parameter) that is concatenated into a SQL query without sanitization. By injecting SQL syntax, the attacker extracts sensitive database contents such as WordPress user records and password hashes. No public exploit code was identified at time of analysis, but the low attack complexity and lack of authentication make exploit development straightforward.