# RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Authenticated (Customer+) Missing Authorization to Appointment Viewing, Creation, Status Modification and Deletion

- **ID:** WPSEC-2026-3113
- **Plugin:** RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (`computer-repair-shop`), https://wordpress.org/plugins/computer-repair-shop/
- **Affected versions:** from 4.1231 before 4.1237
- **Fixed in:** 4.1237 (Update to 4.1237 or later.)
- **Severity:** Medium 6.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/computer-repair-shop
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3113/

## Description

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized access and modification of data via the wcrb_get_appointment_details, wcrb_get_customer_jobs, wcrb_add_appointment, wcrb_update_appointment_status and wcrb_delete_appointment AJAX actions in all versions up to, and including, 4.1236, due to missing capability and ownership checks. The handlers only verify the appointment nonce, which is also given to customers on their My Account appointments screen. This makes it possible for authenticated attackers, with Customer-level access and above, to view the details of any appointment, list any customer's jobs, create appointments for other customers, and change the status of or delete any appointment.

## References

- https://wpsec.com/vuln/WPSEC-2026-3113/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3113/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.