# RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1235 - Unauthenticated Insecure Direct Object Reference to Arbitrary Job Message Posting and Case Number Disclosure via wcrb_post_customer_message_status AJAX Action

- **ID:** WPSEC-2026-2827
- **Plugin:** RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (`computer-repair-shop`), https://wordpress.org/plugins/computer-repair-shop/
- **Affected versions:** from 3.8112 before 4.1236
- **Fixed in:** 4.1236 (Update to 4.1236 or later.)
- **Severity:** Medium 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-10)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/computer-repair-shop
- **Fix released:** 2026-11-09
- **Published:** 2026-11-10
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2827/

## Description

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference via the wcrb_post_customer_message_status AJAX action in all versions up to, and including, 4.1235. This is due to the endpoint checking only a site-wide nonce, which is printed on every job's status form, and not checking that the requester owns the job given in the 'order_id' parameter. The endpoint's response also returns the job's status-check link, which contains the job's secret case number. This makes it possible for unauthenticated attackers who can view the status page of any one job to post customer messages, attachment entries and admin notification emails on arbitrary jobs, and to read the case numbers of those jobs. With a job's case number, an attacker can view that job's details and invoice on the public status page.

## References

- https://wpsec.com/vuln/WPSEC-2026-2827/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1236/
- https://wordpress.org/plugins/computer-repair-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2827/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.