RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Unauthenticated Sensitive Information Exposure via Appointment Details and Customer Jobs AJAX Actions
- ID
- WPSEC-2026-3112
- Plugin
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (computer-repair-shop)
- Affected
- from 4.1236 before 4.1237
- Remediation
- Update to 4.1237 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weakness
- CWE-639
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-13
- Attack surface
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the wcrb_get_appointment_details and wcrb_get_customer_jobs AJAX actions in all versions up to, and including, 4.1236, due to the handlers being registered for logged-out users without any capability or ownership check, while the appointment nonce they require is printed on every front-end page, including for visitors who are not logged in. This makes it possible for unauthenticated attackers to retrieve the details of any appointment, including customer names, email addresses, phone numbers, billing addresses and staff notes, and to list the jobs of any customer.
References
- https://wpsec.com/vuln/WPSEC-2026-3112/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS