The vulnerability stems from an incorrect privilege assignment within the WordPress RepairBuddy plugin, allowing an attacker to elevate privileges. The flaw is a classic privilege escalation issue mapped to CWE-266, where inadequate enforcement of access controls permits users to gain higher permissions than intended. As a result, a compromised or low‑privileged user could gain administrative capabilities, potentially modifying site settings or accessing sensitive data.

Webful Creations' RepairBuddy computer‑repair‑shop plugin, affecting all versions from the earliest (n/a) through 4.1234. Users running any of these versions in a WordPress environment are potentially exposed.

The CVSS score of 6.3 indicates a medium severity risk. EPSS data is not available, so the probability of exploitation is uncertain but not negligible. The vulnerability has not been listed in the CISA KEV catalog, meaning there is no confirmed exploitation in the wild as of now. Attackers would need to identify and access a vulnerable WordPress instance with the plugin installed; typical exploitation could be facilitated by leveraging the plugin’s administrative interface from a compromised low‑privilege account. Without an official workaround, the window for exploitation remains open until the plugin is updated.