RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Authenticated (Customer+) Missing Authorization to Appointment Viewing, Creation, Status Modification and Deletion
- ID
- WPSEC-2026-3113
- Plugin
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (computer-repair-shop)
- Affected
- from 4.1231 before 4.1237
- Remediation
- Update to 4.1237 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-13
- Attack surface
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data via the wcrb_get_appointment_details, wcrb_get_customer_jobs, wcrb_add_appointment, wcrb_update_appointment_status and wcrb_delete_appointment AJAX actions in all versions up to, and including, 4.1236, due to missing capability and ownership checks. The handlers only verify the appointment nonce, which is also given to customers on their My Account appointments screen. This makes it possible for authenticated attackers, with Customer-level access and above, to view the details of any appointment, list any customer's jobs, create appointments for other customers, and change the status of or delete any appointment.
References
- https://wpsec.com/vuln/WPSEC-2026-3113/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS