# RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Appointment Deletion

- **ID:** WPSEC-2026-3111
- **Plugin:** RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (`computer-repair-shop`), https://wordpress.org/plugins/computer-repair-shop/
- **Affected versions:** from 4.1236 before 4.1237
- **Fixed in:** 4.1237 (Update to 4.1237 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/computer-repair-shop
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3111/

## Description

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized data deletion via the wcrb_delete_appointment AJAX action in all versions up to, and including, 4.1236, due to a missing capability check. The handler only checks a nonce, which is printed on every front-end page, and does not check the user's role or whether the user owns the appointment. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete any appointment.

## References

- https://wpsec.com/vuln/WPSEC-2026-3111/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3111/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.