{"id":"CVE-2026-125438","kind":"vulnerability","aliases":["CVE-2026-125438"],"related":[],"title":"RepairBuddy WordPress plugin: missing authorization check exposes repair-shop data","description":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.","summary":"RepairBuddy, a WordPress plugin for computer repair shops by Webful Creations, lacks an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control, which can give access beyond what the site intended.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RepairBuddy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","repairbuddy","self-hosted","wordpress"],"not_affected_if":["default-config","plugin-not-installed"],"how_to_check":"- Check the installed RepairBuddy plugin version in the WordPress admin plugin list or in the plugin's main file header; the sources say it is affected through `4.1235`.\n- Confirm whether the site has the plugin active and whether its access control settings are customised.","fix":"- RepairBuddy: versions after `4.1235` per the affected range; the exact fixed version is unknown from the sources.","status":"open","published_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","triaged_at":"2026-11-11T12:28:49+00:00","updated_at":"2026-11-11T12:28:49+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-11T12:28:49Z","model":"claude-haiku-5-5","output":{"fix":"- RepairBuddy: versions after `4.1235` per the affected range; the exact fixed version is unknown from the sources.","reach":"internet","title":"RepairBuddy WordPress plugin: missing authorization check exposes repair-shop data","impact":"medium","summary":"RepairBuddy, a WordPress plugin for computer repair shops by Webful Creations, lacks an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control, which can give access beyond what the site intended.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","repairbuddy","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach functions meant for staff","analyst_note":"Confirm the fixed version and the exact affected functions from the vendor advisory or the Wordfence/Patchstack record for RepairBuddy.","how_to_check":"- Check the installed RepairBuddy plugin version in the WordPress admin plugin list or in the plugin's main file header; the sources say it is affected through `4.1235`.\n- Confirm whether the site has the plugin active and whether its access control settings are customised.","plain_action":"","product_name":"RepairBuddy","needs_analyst":true,"not_affected_if":["plugin-not-installed","default-config"],"who_is_affected":"Sites running the RepairBuddy plugin for computer repair shops, through version 4.1235, are in scope. The sources describe the flaw as relying on incorrectly configured access control, so sites with default settings may be less exposed; the sources do not say more.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000764,"input_tokens":4542,"output_tokens":620,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125438':14A,17A '-2026':13A,16A '4.1235':88C 'access':52B,57B,78C 'affect':83C 'allow':74C 'attack':47B 'author':5A,38B,64C 'beyond':58B 'check':6A,39B 'comput':30B,71C 'computer-repair-shop':70C 'configur':51B,77C 'control':53B,79C 'creation':35B,68C 'cve':12A,15A 'data':11A 'exploit':49B,75C 'expos':7A 'function':42B 'give':56B 'host':23B 'incorrect':50B,76C 'intend':62B 'issu':82C 'lack':36B 'levels.this':81C 'miss':4A,63C 'n/a':86C 'plugin':3A,28B 'repair':9A,31B,72C 'repair-shop':8A 'repairbuddi':1A,20B,25B,69C,84C 'repairbuddy':18A 'say':45B 'secur':80C 'self':22B 'self-host':21B 'shop':10A,32B,73C 'site':61B 'sourc':44B 'vulner':65C 'web':34B,67C 'wordpress':2A,24B,27B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RepairBuddy plugin for computer repair shops, through version 4.1235, are in scope. The sources describe the flaw as relying on incorrectly configured access control, so sites with default settings may be less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":["repairbuddy"],"ptokens":["repairbuddy"],"labels":["medium","other","repairbuddy","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125438':14A,17A '-2026':13A,16A 'author':5A 'check':6A 'cve':12A,15A 'data':11A 'expos':7A 'miss':4A 'plugin':3A 'repair':9A 'repair-shop':8A 'repairbuddi':1A 'repairbuddy':18A 'shop':10A 'wordpress':2A","search_b":"'access':52B,57B 'attack':47B 'author':38B 'beyond':58B 'check':39B 'comput':30B 'configur':51B 'control':53B 'creation':35B 'exploit':49B 'function':42B 'give':56B 'host':23B 'incorrect':50B 'intend':62B 'lack':36B 'plugin':28B 'repair':31B 'repairbuddi':20B,25B 'say':45B 'self':22B 'self-host':21B 'shop':32B 'site':61B 'sourc':44B 'web':34B 'wordpress':24B,27B","search_c":"'4.1235':88C 'access':78C 'affect':83C 'allow':74C 'author':64C 'comput':71C 'computer-repair-shop':70C 'configur':77C 'control':79C 'creation':68C 'exploit':75C 'incorrect':76C 'issu':82C 'levels.this':81C 'miss':63C 'n/a':86C 'repair':72C 'repairbuddi':69C,84C 'secur':80C 'shop':73C 'vulner':65C 'web':67C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T12:19:49+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125438","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125438","severity":null,"published_at":"2026-11-11T12:19:49+00:00","modified_at":"2026-11-11T12:19:49+00:00","first_seen_at":"2026-11-11T12:27:12+00:00","fetched_at":"2026-11-11T12:27:12+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}