Technical impact
A recent analysis of the RepairBuddy plugin for WordPress shows that any authenticated user can generate a WordPress nonce for any action without capability checks. The second AJAX endpoint verifies only the nonce and updates more than fifteen configuration options without verifying the current user's capability, a flaw that enables subscriber-level users or above to modify crucial settings such as business name, contact email, logo image, menu label, and GDPR compliance options. This missing authorization gives attackers the ability to alter configuration data and potentially mislead customers, disrupt service information, or set the stage for further attacks, although it does not provide a direct path to code execution or data exfiltration.
Affected Systems
The vulnerability affects installations of the RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress produced by sweetdaisy86. All plugin versions up to and including 4.1132 are susceptible; no additional sub-version restrictions are listed. Site owners running the plugin on any WordPress instance should review their configuration for unauthorized changes.
Risk and Exploitability
The CVSS score of 5.3 places the issue in the moderate severity range. No EPSS score is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires only an authenticated WordPress account with subscriber-level or higher capabilities, a low barrier for owners whose accounts may be weak or compromised. Because the flaw enables unilateral configuration changes, the risk is primarily to site integrity and availability rather than confidentiality or availability of source code. The straightforward attack path and lack of further checks make this a realistic concern for sites with loosely controlled user permissions.
