CVE-2026-24638
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The RepairBuddy plugin for WordPress up to version 4.1121 suffers from missing authorization, allowing exploitation of incorrectly configured access control levels.
Risk Assessment
The organization is at risk of unauthorized access to plugin functions by attackers, potentially leading to privilege escalation.
Recommendation
Update the RepairBuddy plugin to the latest version or apply temporary mitigations.
Other vulnerabilities in RepairBuddy
See all- CVE-2026-78291Medium
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
- CVE-2026-39584Medium
RepairBuddy versions up to 4.1132 have a broken access control issue that may allow subscribers unauthorized access to resources.
- CVE-2026-39586Medium
The WordPress plugin RepairBuddy (computer-repair-shop) by Ateeq Rafeeq has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 4.1132.
Original NVD description (English source)
Missing Authorization vulnerability in Webful Creations RepairBuddy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects RepairBuddy: from n/a through 4.1121.