# RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress <= 4.1236 - Missing Authorization to Unauthenticated Appointment Creation and Status Modification

- **ID:** WPSEC-2026-3114
- **Plugin:** RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress (`computer-repair-shop`), https://wordpress.org/plugins/computer-repair-shop/
- **Affected versions:** from 4.1236 before 4.1237
- **Fixed in:** 4.1237 (Update to 4.1237 or later.)
- **Severity:** Medium 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/computer-repair-shop
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3114/

## Description

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data via the wcrb_add_appointment and wcrb_update_appointment_status AJAX actions in all versions up to, and including, 4.1236, due to a missing capability check. The handlers are registered for logged-out users, trust the posted customer, technician and status values, and rely only on a nonce that is printed on every front-end page. This makes it possible for unauthenticated attackers to create appointments for any customer and technician and to change the status of any appointment, which also sends status emails to customers.

## References

- https://wpsec.com/vuln/WPSEC-2026-3114/
- https://plugins.svn.wordpress.org/computer-repair-shop/tags/4.1237/
- https://wordpress.org/plugins/computer-repair-shop/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3114/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.