{"id":"CVE-2026-125825","kind":"vulnerability","aliases":["CVE-2026-125825"],"related":[],"title":"RepairBuddy WordPress plugin: missing authorization lets users bypass access controls","description":"Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1236.","summary":"RepairBuddy, a WordPress plugin for computer repair shops, has a missing authorization check that lets attackers exercise functions they should not reach. The advisory says it affects all versions through 4.1236.","severity":"medium","cvss":5.3,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"RepairBuddy","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["other","repairbuddy","self-hosted","wordpress"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed RepairBuddy plugin version in the WordPress admin under Plugins.\n- Compare it against the fixed version (unknown from the sources).","fix":null,"status":"open","published_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","triaged_at":"2026-11-13T15:49:00+00:00","updated_at":"2026-11-13T15:49:00+00:00","category":"other","confidence":0.5,"triage":{"at":"2026-11-13T15:49:00Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"RepairBuddy WordPress plugin: missing authorization lets users bypass access controls","impact":"medium","summary":"RepairBuddy, a WordPress plugin for computer repair shops, has a missing authorization check that lets attackers exercise functions they should not reach. The advisory says it affects all versions through 4.1236.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","repairbuddy","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"unauthorized users reach restricted plugin functions and data","analyst_note":"Confirm the fixed version and the exact unauthorized function from the NVD entry or the Wordfence/vendor advisory.","how_to_check":"- Check the installed RepairBuddy plugin version in the WordPress admin under Plugins.\n- Compare it against the fixed version (unknown from the sources).","plain_action":"","product_name":"RepairBuddy","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running the RepairBuddy computer-repair-shop WordPress plugin at version 4.1236 or earlier. Sites without this plugin are not affected. The sources do not say which roles or settings are needed to reach the flawed function.","user_interaction":"unknown","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000718,"input_tokens":4542,"output_tokens":528,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-125825':13A,16A '-2026':12A,15A '4.1236':54B,80C 'access':9A,70C 'advisori':47B 'affect':50B,75C 'allow':66C 'attack':39B 'author':5A,35B,56C 'bypass':8A 'check':36B 'comput':29B,63C 'computer-repair-shop':62C 'configur':69C 'control':10A,71C 'creation':60C 'cve':11A,14A 'exercis':40B 'exploit':67C 'function':41B 'host':22B 'incorrect':68C 'issu':74C 'let':6A,38B 'levels.this':73C 'miss':4A,34B,55C 'n/a':78C 'plugin':3A,27B 'reach':45B 'repair':30B,64C 'repairbuddi':1A,19B,24B,61C,76C 'repairbuddy':17A 'say':48B 'secur':72C 'self':21B 'self-host':20B 'shop':31B,65C 'user':7A 'version':52B 'vulner':57C 'web':59C 'wordpress':2A,23B,26B","nicknames":[],"mitigations":[],"who_affected":"Sites running the RepairBuddy computer-repair-shop WordPress plugin at version 4.1236 or earlier. Sites without this plugin are not affected. The sources do not say which roles or settings are needed to reach the flawed function.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["repairbuddy"],"ptokens":["repairbuddy"],"labels":["medium","other","repairbuddy","selfhosted","vendor","wordpress"],"campaign_type":null,"search_a":"'-125825':13A,16A '-2026':12A,15A 'access':9A 'author':5A 'bypass':8A 'control':10A 'cve':11A,14A 'let':6A 'miss':4A 'plugin':3A 'repairbuddi':1A 'repairbuddy':17A 'user':7A 'wordpress':2A","search_b":"'4.1236':54B 'advisori':47B 'affect':50B 'attack':39B 'author':35B 'check':36B 'comput':29B 'exercis':40B 'function':41B 'host':22B 'let':38B 'miss':34B 'plugin':27B 'reach':45B 'repair':30B 'repairbuddi':19B,24B 'say':48B 'self':21B 'self-host':20B 'shop':31B 'version':52B 'wordpress':23B,26B","search_c":"'4.1236':80C 'access':70C 'affect':75C 'allow':66C 'author':56C 'comput':63C 'computer-repair-shop':62C 'configur':69C 'control':71C 'creation':60C 'exploit':67C 'incorrect':68C 'issu':74C 'levels.this':73C 'miss':55C 'n/a':78C 'repair':64C 'repairbuddi':61C,76C 'secur':72C 'shop':65C 'vulner':57C 'web':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T15:17:41+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-125825","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-125825","severity":null,"published_at":"2026-11-13T15:17:41+00:00","modified_at":"2026-11-13T15:17:41+00:00","first_seen_at":"2026-11-13T15:46:18+00:00","fetched_at":"2026-11-13T15:46:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}