sweetdaisy86 RepairBuddy Plugin up to 4.1132 on WordPress AJAX wc_rb_get_fresh_nonce nonce_name authorization

Summaryinfo

A vulnerability was found in sweetdaisy86 RepairBuddy Plugin up to 4.1132 on WordPress and classified as critical. This affects the function wc_rb_get_fresh_nonce of the component AJAX Handler. Such manipulation of the argument nonce_name leads to authorization. This vulnerability is traded as CVE-2026-3567. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability, which was classified as critical, has been found in sweetdaisy86 RepairBuddy Plugin up to 4.1132 on WordPress. Affected by this issue is the function wc_rb_get_fresh_nonce of the component AJAX Handler. The manipulation of the argument nonce_name with an unknown input leads to a authorization vulnerability. Using CWE to declare the problem leads to CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. Impacted is confidentiality, integrity, and availability. CVE summarizes:

The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.

The weakness was shared by Yoschanin Pulsirivong, Ronnachai Sretawat Na Ayutaya and Ronnachai Chaipha. The advisory is shared for download at wordfence.com. This vulnerability is handled as CVE-2026-3567 since 03/04/2026. The exploitation is known to be easy. The attack may be launched remotely. No form of authentication is required for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 4.1121 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• sweetdaisy86

Name

• RepairBuddy Plugin

Version

• 4.1132

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion