CVE-2026-0820
📋 TL;DR
This vulnerability allows authenticated WordPress users with Subscriber-level access or higher to upload arbitrary signatures to any order in the RepairBuddy plugin. Attackers can modify order metadata and trigger unauthorized status changes, potentially disrupting business operations. All WordPress sites using vulnerable versions of the RepairBuddy plugin are affected.
💻 Affected Systems
- RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers could manipulate order statuses to mark repairs as completed without actual work, issue fraudulent refunds, or delete critical order data, causing financial loss and operational disruption.
Likely Case
Attackers modify order metadata to change repair statuses, add unauthorized notes, or upload inappropriate signature images, leading to customer confusion and minor operational issues.
If Mitigated
With proper access controls and monitoring, impact is limited to minor data integrity issues that can be quickly detected and corrected.
🎯 Exploit Status
Exploitation requires authenticated access but is straightforward once authenticated. The vulnerability is well-documented in public sources.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions after 4.1116
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins → Installed Plugins. 3. Find RepairBuddy plugin. 4. Click 'Update Now' if available. 5. If no update appears, manually download latest version from WordPress repository and replace plugin files.
🔧 Temporary Workarounds
Disable vulnerable function via code modification
allAdd capability checks to the wc_upload_and_save_signature_handler function to restrict access to authorized users only.
Edit class-wcrb_signature.php file at line 562 and add: if (!current_user_can('manage_options')) { wp_die('Unauthorized'); }
Temporarily disable signature uploads
allRemove or comment out the signature upload functionality until patch is applied.
Comment out lines 562-580 in class-wcrb_signature.php or rename the wc_upload_and_save_signature_handler function
🧯 If You Can't Patch
- Restrict user registration and review existing user accounts to ensure no unauthorized subscribers exist
- Implement web application firewall rules to block requests to the vulnerable endpoint (/wp-admin/admin-ajax.php?action=wc_upload_and_save_signature)
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel → Plugins → RepairBuddy → Version. If version is 4.1116 or lower, you are vulnerable.Check Version:
wp plugin list --name=repairbuddy --field=versionVerify Fix Applied:
After updating, verify version is higher than 4.1116. Test signature upload functionality with a subscriber account to confirm proper access controls.📡 Detection & Monitoring
Log Indicators:
- Multiple POST requests to /wp-admin/admin-ajax.php with action=wc_upload_and_save_signature from non-admin users
- Unusual order status changes or signature uploads from subscriber accounts
Network Indicators:
- HTTP POST requests to WordPress admin-ajax endpoint with signature upload parameters from unexpected user roles
SIEM Query:
source="wordpress.log" AND (uri_path="/wp-admin/admin-ajax.php" AND parameters.action="wc_upload_and_save_signature") AND user_role!="administrator" AND user_role!="shop_manager"🔗 References
- https://plugins.trac.wordpress.org/browser/computer-repair-shop/tags/4.1116/lib/includes/classes/class-wcrb_signature.php#L562
- https://plugins.trac.wordpress.org/browser/computer-repair-shop/trunk/lib/includes/classes/class-wcrb_signature.php#L562
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3436356%40computer-repair-shop&new=3436356%40computer-repair-shop&sfp_email=&sfph_mail=
- https://www.wordfence.com/threat-intel/vulnerabilities/id/1b2ad299-03b1-4b9e-a241-d2ad2d85c3ac?source=cve
