{
 "id": "WPSEC-2026-3113",
 "url": "https://wpsec.com/vuln/WPSEC-2026-3113/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-3113/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-3113/index.md",
 "title": "RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Authenticated (Customer+) Missing Authorization to Appointment Viewing, Creation, Status Modification and Deletion",
 "description": "The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data via the wcrb_get_appointment_details, wcrb_get_customer_jobs, wcrb_add_appointment, wcrb_update_appointment_status and wcrb_delete_appointment AJAX actions in all versions up to, and including, 4.1236, due to missing capability and ownership checks. The handlers only verify the appointment nonce, which is also given to customers on their My Account appointments screen. This makes it possible for authenticated attackers, with Customer-level access and above, to view the details of any appointment, list any customer's jobs, create appointments for other customers, and change the status of or delete any appointment.",
 "plugin": {
  "slug": "computer-repair-shop",
  "name": "RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress",
  "full_name": "RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress",
  "wordpress_org": "https://wordpress.org/plugins/computer-repair-shop/",
  "advisories_url": "https://wpsec.com/vuln/plugin/computer-repair-shop/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/computer-repair-shop"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 6.3,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": "4.1231",
    "from_inclusive": true,
    "to": "4.1237",
    "to_inclusive": false
   }
  ],
  "text": [
   "from 4.1231 before 4.1237"
  ]
 },
 "introduced_in": "4.1231",
 "fixed_in": "4.1237",
 "remediation": "Update to 4.1237 or later.",
 "fix_released": "2026-11-12T22:00:38+00:00",
 "published": "2026-11-13T22:41:21+00:00",
 "updated": "2026-11-13T15:53:10.371788+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-3113/",
  "https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/",
  "https://wordpress.org/plugins/computer-repair-shop/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/computer-repair-shop",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-11-13"
 }
}