{"id":"CVE-2026-125434","kind":"vulnerability","aliases":["CVE-2026-125434"],"related":[],"title":"RepairBuddy WordPress plugin: missing authorization check exposes data","description":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.","summary":"RepairBuddy, a WordPress plugin for computer repair shops by Webful Creations, has a missing authorization check that allows access controls to be bypassed. The sources do not state what data or actions an attacker gains beyond that.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RepairBuddy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","repairbuddy","webful-creations","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check whether the RepairBuddy plugin is installed and its version in the WordPress admin plugins page\n- Compare the installed version against the range `4.1235` listed as affected in the NVD entry","fix":"- RepairBuddy: unknown (sources give only the affected range through `4.1235`, no fixed version)","status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","triaged_at":"2026-11-11T12:28:42+00:00","updated_at":"2026-11-11T12:28:42+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T12:28:42Z","model":"claude-haiku-5-5","output":{"fix":"- RepairBuddy: unknown (sources give only the affected range through `4.1235`, no fixed version)","reach":"internet","title":"RepairBuddy WordPress plugin: missing authorization check exposes data","impact":"medium","summary":"RepairBuddy, a WordPress plugin for computer repair shops by Webful Creations, has a missing authorization check that allows access controls to be bypassed. The sources do not state what data or actions an attacker gains beyond that.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","repairbuddy","webful-creations"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users may reach restricted plugin functions","analyst_note":"Confirm the fixed version and the exact unauthorized action from the Wordfence or vendor advisory; NVD gives only the affected range.","how_to_check":"- Check whether the RepairBuddy plugin is installed and its version in the WordPress admin plugins page\n- Compare the installed version against the range `4.1235` listed as affected in the NVD entry\n- unknown for other checks","plain_action":"","product_name":"RepairBuddy","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the RepairBuddy plugin (computer-repair-shop) from Webful Creations, up to and including version 4.1235, are in the affected range. Sites without this plugin are not affected. Whether authentication is needed is unknown from the sources.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4542,"output_tokens":593,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125434':11A,14A '-2026':10A,13A '4.1235':83C 'access':40B,73C 'action':53B 'affect':78C 'allow':39B,69C 'attack':55B 'author':5A,36B,59C 'beyond':57B 'bypass':44B 'check':6A,37B 'comput':27B,66C 'computer-repair-shop':65C 'configur':72C 'control':41B,74C 'creation':20B,32B,63C 'cve':9A,12A 'data':8A,51B 'exploit':70C 'expos':7A 'gain':56B 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':4A,35B,58C 'n/a':81C 'plugin':3A,25B 'repair':28B,67C 'repairbuddi':1A,17B,22B,64C,79C 'repairbuddy':15A 'secur':75C 'shop':29B,68C 'sourc':46B 'state':49B 'vulner':60C 'web':19B,31B,62C 'webful-cr':18B 'wordpress':2A,21B,24B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RepairBuddy plugin (computer-repair-shop) from Webful Creations, up to and including version 4.1235, are in the affected range. Sites without this plugin are not affected. Whether authentication is needed is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["repairbuddy"],"ptokens":["repairbuddy"],"labels":["medium","other","repairbuddy","vendor","webfulcreations","wordpress"],"campaign_type":null,"search_a":"'-125434':11A,14A '-2026':10A,13A 'author':5A 'check':6A 'cve':9A,12A 'data':8A 'expos':7A 'miss':4A 'plugin':3A 'repairbuddi':1A 'repairbuddy':15A 'wordpress':2A","search_b":"'access':40B 'action':53B 'allow':39B 'attack':55B 'author':36B 'beyond':57B 'bypass':44B 'check':37B 'comput':27B 'control':41B 'creation':20B,32B 'data':51B 'gain':56B 'miss':35B 'plugin':25B 'repair':28B 'repairbuddi':17B,22B 'shop':29B 'sourc':46B 'state':49B 'web':19B,31B 'webful-cr':18B 'wordpress':21B,24B","search_c":"'4.1235':83C 'access':73C 'affect':78C 'allow':69C 'author':59C 'comput':66C 'computer-repair-shop':65C 'configur':72C 'control':74C 'creation':63C 'exploit':70C 'incorrect':71C 'issu':77C 'levels.this':76C 'miss':58C 'n/a':81C 'repair':67C 'repairbuddi':64C,79C 'secur':75C 'shop':68C 'vulner':60C 'web':62C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125434","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125434","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:11+00:00","fetched_at":"2026-11-11T12:27:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}