What the vulnerability does
01Description
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions up to, and including, 4.1116. This makes it possible for authenticated attackers, with Subscriber-level access and above, to upload arbitrary signatures to any order in the system, potentially modifying order metadata and triggering unauthorized status changes.
Explanation of Vulnerability in Simple Terms
02Summary
RepairBuddy versions up to 4.1116 lack proper authorization checks, allowing authenticated users to modify data they should not have access to. An attacker with a low-privilege account can alter records without the plugin verifying their permissions. This affects the integrity of repair shop data and booking information. Update to a version newer than 4.1116.
What an attacker can do
03Attacker Capabilities
Modify repair records, bookings, or customer data belonging to other users or restricted areas.
Potential impact on your site
04Site Impact
Repair shop data and customer bookings can be altered by low-privilege staff or compromised accounts.
Conditions required to exploit
05Prerequisites
Attacker must have a valid WordPress user account with at least subscriber-level access.
Key dates
06Disclosure timeline
January 17, 2026
CVE published
April 16, 2026
Record updated
