---
id: "CVE-2026-125438"
page: "https://infrastack.ai/live/CVE-2026-125438"
kind: "vulnerability"
aliases: ["CVE-2026-125438"]
title: "RepairBuddy WordPress plugin: missing authorization check exposes repair-shop data"
severity: "medium"
cvss: 5.3
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "RepairBuddy", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["other", "repairbuddy", "self-hosted", "wordpress"]
not_affected_if: ["default-config", "plugin-not-installed"]
published_at: "2026-11-11T12:19:49+00:00"
first_seen_at: "2026-11-11T12:27:12+00:00"
updated_at: "2026-11-11T12:28:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-125438", "first_seen_at": "2026-11-11T12:27:12+00:00"}]
exploit_sources: []
---

# RepairBuddy WordPress plugin: missing authorization check exposes repair-shop data

Link for people: https://infrastack.ai/live/CVE-2026-125438 (this .md is for agents)

RepairBuddy, a WordPress plugin for computer repair shops by Webful Creations, lacks an authorization check on some functionality. The sources say an attacker can exploit incorrectly configured access control, which can give access beyond what the site intended.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:RepairBuddy affected range not listed fixed no fixed version listed

## How to check

- Check the installed RepairBuddy plugin version in the WordPress admin plugin list or in the plugin's main file header; the sources say it is affected through `4.1235`.
- Confirm whether the site has the plugin active and whether its access control settings are customised.

## Fix

- RepairBuddy: versions after `4.1235` per the affected range; the exact fixed version is unknown from the sources.

## Timeline

- 2026-11-11T12:27:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-125438

## From the sources

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_