RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Missing Authorization to Unauthenticated Appointment Creation and Status Modification
- ID
- WPSEC-2026-3114
- Plugin
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (computer-repair-shop)
- Affected
- from 4.1236 before 4.1237
- Remediation
- Update to 4.1237 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-11-13
- Attack surface
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress on WPSec AttackSurface
- Fix released
- Published
Description
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data via the wcrb_add_appointment and wcrb_update_appointment_status AJAX actions in all versions up to, and including, 4.1236, due to a missing capability check. The handlers are registered for logged-out users, trust the posted customer, technician and status values, and rely only on a nonce that is printed on every front-end page. This makes it possible for unauthenticated attackers to create appointments for any customer and technician and to change the status of any appointment, which also sends status emails to customers.
References
- https://wpsec.com/vuln/WPSEC-2026-3114/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS