Webful Creations RepairBuddy: Missing authorization check in WordPress plugin
Summary
The WordPress plugin RepairBuddy (computer-repair-shop), up to and including version 4.1235, lacks a proper authorization check. An attacker with a valid low-privilege account, such as a contributor, may access pages or perform actions they should not be allowed to, for example viewing other users' data. Confidentiality is not affected according to the CVSS vector, but integrity and availability are partly affected. No exploitation is known so far.
Affected
- RepairBuddy WordPress plugin (slug computer-repair-shop) from n/a through 4.1235
- Required privilege: low (for example contributor)
Fixed in
- Version 4.1236 (according to the CVE record and a secondary tracker; not yet verified against the vendor changelog)
Workaround
- No vendor or CNA workaround is documented.
- Restrict or disable self-registration and review low-privilege accounts.
- Audit recent plugin-setting and user changes.
- Deactivate the plugin on sites where it is not business-critical.
Exploitation
- Not known to be exploited (KEV: No).
- No public proof of concept found.
Our recommendation
- Inventory all WordPress sites with RepairBuddy and record their versions.
- Update to version 4.1236 or later and confirm the fix in the wordpress.org changelog.
- Review user accounts and plugin settings for unexpected changes.
- Disable self-registration where it is not needed.
- Treat installations on older versions as higher priority, since earlier RepairBuddy flaws were more severe.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-125434 www.cve.org
- Patchstack advisory patchstack.com
- OffSeq threat radar (CVE-2026-125434) radar.offseq.com
- Strix CVE record CVE-2026-125434 www.strix.ai
- Related record CVE-2026-125438 (possible duplicate) radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 17:14.
Original description (NVD)
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RepairBuddy: from n/a through 4.1235.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.