Which versions of RepairBuddy are affected by CVE-2026-97309?

Organizations using the RepairBuddy WordPress plugin (versions through 4.1226) face a high-severity vulnerability that could expose embedded sensitive data, potentially leading to data breaches,…

How to fix or mitigate CVE-2026-97309?

No vendor-released patch identified at time of analysis. Within 24 hours, identify all WordPress instances running RepairBuddy plugin versions through 4.1226 and assess their business criticality; if the plugin is not essential, temporarily disable it, and if it must remain active, restrict access to necessary personnel and enable detailed logging. Within 7 days, implement compensating controls such as web application firewall rules if feasible, review and minimize user privileges, monitor for unauthorized data access, and contact the vendor to obtain a patch timeline; also prepare a data breach response plan. Within 30 days, apply the vendor patch as soon as it is released, or if no patch is forthcoming, evaluate replacing the plugin with a secure alternative or decommissioning it; conduct a comprehensive security audit of all WordPress installations and update incident response procedures accordingly.

RepairBuddy CVE-2026-97309

Q: What is the CVSS score of CVE-2026-97309?

CVE-2026-97309 has a CVSS 4.0 base score of 7.1 (High). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-92588 HIGH

Missing Authorization (CWE-862)

2026-10-05 Patchstack

GHSA-w384-r393-g736

WordPress Authentication Bypass Information Disclosure Repairbuddy Wordpress Plugin Webful Creations

7.1

CVSS 4.0 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.1 HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

6.5 MEDIUM

Network-reachable, low-complexity data access requiring a minimal authenticated account (PR:L); confidentiality-only impact (C:H, I/A:N) per the missing-authorization sensitive-data-exposure nature.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Oct 05, 2026 - 19:06 vuln.today

CVE Published

Oct 05, 2026 - 18:08 cve.org

HIGH 7.1

DescriptionCVE.org

Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.

Articles & Coverage 1

News 17 New WordPress Vulnerabilities - 2 Critical, 15 High Severity Oct 06, 2026

AnalysisAI

Authenticated low-privilege users can retrieve embedded sensitive data from WordPress sites running the RepairBuddy plugin (versions through 4.1226) due to a missing authorization check. This moderate-severity vulnerability (CVSS 7.1) impacts only confidentiality, requires a valid account with minimal privileges, and has no public exploit code or active exploitation reported.

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

No credit card · 7-day full trial

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Access

technique details hidden

Exploit

technique details hidden

Execution

technique details hidden

Impact

technique details hidden

Vulnerability AssessmentAI

Exploitation	Exploitation requires an authenticated low-privilege account on the target WordPress site running the RepairBuddy (computer-repair-shop) plugin version n/a through 4.1226 (PR:L), reachable over the network with no user interaction. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	This is a moderate-priority issue, not a top-tier emergency. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation	No vendor-released patch is available at this time. … Detailed patch versions, workarounds, and compensating controls in full report.