CVE-2026-0820: 
WordPress vulnerability analysis and mitigation

CVE-2026-0820 is an Insecure Direct Object Reference (IDOR) vulnerability in the RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress, affecting all versions up to and including 4.1116. The flaw stems from missing capability checks on the wc_upload_and_save_signature_handler function, allowing authenticated attackers with Subscriber-level access or above to upload arbitrary signatures to any order in the system. It was disclosed on January 16–17, 2026, with the CVE assigned by Wordfence. The CVSS v3.1 base score is 4.3 (Medium), as scored by Wordfence (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-862 (Missing Authorization) and manifests as an Insecure Direct Object Reference (IDOR) in the wc_upload_and_save_signature_handler function within class-wcrb_signature.php (line 562). Because the function does not verify whether the authenticated user has the appropriate capability to modify a given order, any subscriber-level WordPress user can craft a request targeting an arbitrary order ID and upload a signature file to it. This can result in modification of order metadata and unauthorized triggering of order status changes. The vulnerable code is publicly visible in the WordPress plugin repository (WordPress Trac, Wordfence).

Successful exploitation allows authenticated attackers with minimal privileges (Subscriber-level) to upload arbitrary signatures to any WooCommerce order in the system, potentially altering order metadata and triggering unauthorized status changes across all orders. While there is no confidentiality or availability impact, the integrity impact affects the entire order management system of the affected WordPress site, which could disrupt business operations, falsify repair records, or manipulate order workflows in a repair shop context (Wordfence, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-0820. The EPSS score is approximately 0.028% (0.000280), indicating a very low probability of exploitation in the near term. The vulnerability requires authenticated access (Subscriber-level or above), which limits the attack surface compared to unauthenticated flaws. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog (Wordfence).

1. Obtain Subscriber-level access: Register or log in to the target WordPress site as a subscriber-level user (or any authenticated role).
2. Identify target order IDs: Browse or enumerate WooCommerce order IDs on the site. Order IDs are often sequential integers and may be discoverable through normal user interactions or by observing URL patterns.
3. Craft a malicious request: Send an HTTP POST request to the endpoint that invokes wc_upload_and_save_signature_handler, supplying an arbitrary order ID and a signature file (image or other file) as the payload.
4. Upload signature to target order: Because no capability check is performed, the server accepts the upload and associates the signature with the specified order, regardless of whether the attacker owns or has rights to that order.
5. Trigger unauthorized status change: Depending on plugin logic, the signature upload may automatically trigger an order status update (e.g., marking an order as completed or signed), disrupting order management for the shop owner (Wordfence, WordPress Trac).

• Logs: WordPress or WooCommerce access logs showing POST requests to the signature upload handler (wc_upload_and_save_signature_handler) from subscriber-level user accounts, especially targeting order IDs not associated with that user.
• File System: Unexpected signature image files appearing in the WordPress uploads directory associated with orders that the uploading user does not own.
• Application Behavior: Unexpected order status changes (e.g., orders marked as signed or completed) without corresponding legitimate customer or admin action, particularly across multiple unrelated orders in a short timeframe.

Users should update the RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress to a version beyond 4.1116, which includes the fix for the missing capability check. The patch is available in the plugin's trunk repository on WordPress.org. Until an update can be applied, site administrators should consider restricting subscriber-level user registrations or disabling the plugin if untrusted users have access to the WordPress site (Wordfence, WordPress Trac Changeset).

The vulnerability was reported and assigned by Wordfence, which published a threat intelligence entry for it. Coverage has been limited to automated vulnerability aggregators and national CERT advisories (e.g., INCIBE-CERT, CCN-CERT), with no notable independent researcher commentary or significant social media discussion identified (Wordfence).