CVE-2026-97309
HighCVSS 7.1Exploitation Probability (EPSS)
Low risk12th percentile - higher than 12% of all known CVEs
Summary
The RepairBuddy WordPress plugin (versions up to 4.1226) contains a Missing Authorization vulnerability that allows retrieval of embedded sensitive data. The lack of proper access control enables an unauthenticated user to access sensitive information.
Risk Assessment
An attacker could gain access to sensitive data stored by the plugin, leading to information disclosure and a breach of confidentiality. In a WordPress site context, this poses a direct threat to data security.
Recommendation
Update the RepairBuddy plugin to a version later than 4.1226 as soon as possible if available, or consider disabling it until a patch is released. It is also advisable to verify whether the plugin is essential in the production environment.
Other vulnerabilities in RepairBuddy
See all- CVE-2026-81803High
The RepairBuddy plugin in versions up to 4.1224 contains a Remote Code Execution (RCE) vulnerability. An attacker with subscriber privileges can execute code remotely.
- CVE-2026-100509Medium
The RepairBuddy plugin for WordPress (computer-repair-shop) is vulnerable to stored XSS due to improper neutralization of input during web page generation. This affects versions from n/a through 4.1225.
- CVE-2026-78291Medium
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
- CVE-2026-39584Medium
RepairBuddy versions up to 4.1132 have a broken access control issue that may allow subscribers unauthorized access to resources.
- CVE-2026-24638Medium
The RepairBuddy plugin for WordPress up to version 4.1121 suffers from missing authorization, allowing exploitation of incorrectly configured access control levels.
- CVE-2026-39586Medium
The WordPress plugin RepairBuddy (computer-repair-shop) by Ateeq Rafeeq has a vulnerability that inserts sensitive information into sent data, allowing retrieval of embedded sensitive data. This affects versions up to and including 4.1132.
Original NVD description (English source)
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS