# RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Unauthenticated Sensitive Information Exposure via Appointment Details and Customer Jobs AJAX Actions

- **ID:** WPSEC-2026-3112
- **Plugin:** RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (`computer-repair-shop`), https://wordpress.org/plugins/computer-repair-shop/
- **Affected versions:** from 4.1236 before 4.1237
- **Fixed in:** 4.1237 (Update to 4.1237 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
- **Weakness:** CWE-639
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/computer-repair-shop
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3112/

## Description

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure via the wcrb_get_appointment_details and wcrb_get_customer_jobs AJAX actions in all versions up to, and including, 4.1236, due to the handlers being registered for logged-out users without any capability or ownership check, while the appointment nonce they require is printed on every front-end page, including for visitors who are not logged in. This makes it possible for unauthenticated attackers to retrieve the details of any appointment, including customer names, email addresses, phone numbers, billing addresses and staff notes, and to list the jobs of any customer.

## References

- https://wpsec.com/vuln/WPSEC-2026-3112/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3112/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.