Unauthorized Access Vulnerability in RepairBuddy Plugin for WordPress

CVE-2026-3567

What is CVE-2026-3567?

The RepairBuddy plugin for WordPress exposes significant security flaws by permitting unauthorized access to its admin-level settings. All versions up to 4.1132 are affected. The wc_rb_get_fresh_nonce() function allows any authenticated user to generate a valid nonce without proper capability checks. Combined with the wc_rep_shop_settings_submission() function, this vulnerability enables users with only subscriber-level access to alter critical plugin settings, such as business name, email, logo, menu labels, and GDPR compliance settings. This lack of stringent checks presents a major risk, potentially allowing malicious actors to conduct unauthorized changes to affected sites.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References