The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress contains an Insecure Direct Object Reference flaw in the wc_upload_and_save_signature_handler function. The missing capability check allows any authenticated user with Subscriber role or higher to upload an arbitrary signature file to any order, thereby manipulating order metadata and triggering unauthorized status changes. This undermines the integrity of order data and can be used to tamper with customer records or order processing logic.

The vulnerability affects the sweetdaisy86 RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress, all releases up to and including version 4.1116. Sites running this plugin without an update to a later release are exposed.

The CVSS score of 4.3 indicates a moderate severity issue, and the EPSS score of less than 1% reflects a very low probability of exploitation in the wild. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Attackers need only authenticated access with a Subscriber role or higher, which is typically granted to standard site users. The exploit path is straightforward: an attacker logs in, targets the upload endpoint, and supplies a signature file to modify any order’s data. Because the vulnerability lacks an elevated privilege requirement, the risk is dominated by the potential for data integrity compromise rather than widespread system compromise.