CVE-2026-39586
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The WordPress plugin RepairBuddy (computer-repair-shop) by Ateeq Rafeeq has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 4.1132.
Risk Assessment
An attacker may intercept sensitive data (e.g., passwords, API keys) transmitted by the plugin, potentially leading to further security breaches.
Recommendation
Update the RepairBuddy plugin to a version above 4.1132 if a patch is available, or audit configuration for data leakage.
Other vulnerabilities in RepairBuddy
See all- CVE-2026-81803High
The RepairBuddy plugin in versions up to 4.1224 contains a Remote Code Execution (RCE) vulnerability. An attacker with subscriber privileges can execute code remotely.
- CVE-2026-78291Medium
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
- CVE-2026-39584Medium
RepairBuddy versions up to 4.1132 have a broken access control issue that may allow subscribers unauthorized access to resources.
- CVE-2026-24638Medium
The RepairBuddy plugin for WordPress up to version 4.1121 suffers from missing authorization, allowing exploitation of incorrectly configured access control levels.
Original NVD description (English source)
Insertion of Sensitive Information Into Sent Data vulnerability in Ateeq Rafeeq RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through <= 4.1132.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS