{"id":"CVE-2026-119514","kind":"vulnerability","aliases":["CVE-2026-119514"],"related":[],"title":"RepairBuddy WordPress plugin: incorrect privilege assignment allows privilege escalation","description":"Incorrect Privilege Assignment vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Privilege Escalation.This issue affects RepairBuddy: from n/a through 4.1234.","summary":"RepairBuddy, a computer-repair-shop plugin from Webful Creations, assigns privileges incorrectly. An account with limited access can escalate its privileges, per the NVD description.","severity":"medium","cvss":6.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RepairBuddy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","repairbuddy","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed RepairBuddy version in the plugin list or the plugin's readme; the sources name versions only as \"through 4.1234\".","fix":"- Move to a RepairBuddy release later than `4.1234`; the sources do not name the fixed version.","status":"open","published_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","triaged_at":"2026-11-09T10:26:25+00:00","updated_at":"2026-11-09T10:26:25+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-09T10:26:25Z","model":"claude-haiku-5-5","output":{"fix":"- Move to a RepairBuddy release later than `4.1234`; the sources do not name the fixed version.","reach":"unknown","title":"RepairBuddy WordPress plugin: incorrect privilege assignment allows privilege escalation","impact":"medium","summary":"RepairBuddy, a computer-repair-shop plugin from Webful Creations, assigns privileges incorrectly. An account with limited access can escalate its privileges, per the NVD description.","audience":"businesses","category":"other","nicknames":[],"who_cares":["repairbuddy","wordpress","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"low-privilege user gains higher site privileges","analyst_note":"Confirm the fixed version and the required account level from the Wordfence or vendor advisory; NVD lists no fixed version.","how_to_check":"- Check the installed RepairBuddy version in the plugin list or the plugin's readme; the sources name versions only as \"through 4.1234\".\n- unknown","plain_action":"","product_name":"RepairBuddy","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the RepairBuddy computer-repair-shop plugin at version 4.1234 or earlier are in the stated range. The sources do not say what role or configuration an attacker needs, so unknown. Sites without the plugin can skip it.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4538,"output_tokens":556,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119514':12A,15A '-2026':11A,14A '4.1234':70C 'access':40B 'account':37B 'affect':65C 'allow':7A,61C 'assign':6A,33B,51C 'comput':26B,58C 'computer-repair-shop':25B,57C 'creation':32B,55C 'cve':10A,13A 'descript':48B 'escal':9A,42B 'escalation.this':63C 'host':21B 'incorrect':4A,35B,49C 'issu':64C 'limit':39B 'n/a':68C 'nvd':47B 'per':45B 'plugin':3A,29B 'privileg':5A,8A,34B,44B,50C,62C 'repair':27B,59C 'repairbuddi':1A,18B,23B,56C,66C 'repairbuddy':16A 'self':20B 'self-host':19B 'shop':28B,60C 'vulner':52C 'web':31B,54C 'wordpress':2A,22B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RepairBuddy computer-repair-shop plugin at version 4.1234 or earlier are in the stated range. The sources do not say what role or configuration an attacker needs, so unknown. Sites without the plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["repairbuddy"],"ptokens":["repairbuddy"],"labels":["medium","other","repairbuddy","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-119514':12A,15A '-2026':11A,14A 'allow':7A 'assign':6A 'cve':10A,13A 'escal':9A 'incorrect':4A 'plugin':3A 'privileg':5A,8A 'repairbuddi':1A 'repairbuddy':16A 'wordpress':2A","search_b":"'access':40B 'account':37B 'assign':33B 'comput':26B 'computer-repair-shop':25B 'creation':32B 'descript':48B 'escal':42B 'host':21B 'incorrect':35B 'limit':39B 'nvd':47B 'per':45B 'plugin':29B 'privileg':34B,44B 'repair':27B 'repairbuddi':18B,23B 'self':20B 'self-host':19B 'shop':28B 'web':31B 'wordpress':22B","search_c":"'4.1234':70C 'affect':65C 'allow':61C 'assign':51C 'comput':58C 'computer-repair-shop':57C 'creation':55C 'escalation.this':63C 'incorrect':49C 'issu':64C 'n/a':68C 'privileg':50C,62C 'repair':59C 'repairbuddi':56C,66C 'shop':60C 'vulner':52C 'web':54C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-09T10:17:06+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119514","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119514","severity":null,"published_at":"2026-11-09T10:17:06+00:00","modified_at":"2026-11-09T10:17:06+00:00","first_seen_at":"2026-11-09T10:25:48+00:00","fetched_at":"2026-11-09T10:25:48+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}