CVE-2026-3567: 
WordPress vulnerability analysis and mitigation

CVE-2026-3567 is a Missing Authorization vulnerability in the RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress, affecting all versions up to and including 4.1132. The flaw allows any authenticated user (subscriber-level and above) to modify admin-level plugin settings by exploiting two improperly secured AJAX handlers. It was published on March 21, 2026, and carries a CVSS v3.1 base score of 5.3 (Medium) (Feedly, CVE.org).

The vulnerability is classified as CWE-862 (Missing Authorization) and stems from two flawed AJAX handlers in the plugin. First, wc_rb_get_fresh_nonce() — registered via both wp_ajax and wp_ajax_nopriv hooks — allows any user (including unauthenticated users) to generate a valid WordPress nonce for any arbitrary action name by supplying a nonce_name parameter, with no capability checks enforced. Second, wc_rep_shop_settings_submission() only validates the nonce (wcrb_main_setting_nonce) but performs no current_user_can() check before calling update_option() to modify 15+ plugin settings. An attacker first mints a valid nonce via the wc_rb_get_fresh_nonce endpoint, then calls the settings submission handler to overwrite plugin configuration (Feedly, CVEfeed).

Successful exploitation allows authenticated attackers with subscriber-level access or above to modify all RepairBuddy plugin configuration settings, including business name, email address, logo, menu labels, and GDPR settings. While confidentiality and availability are not directly impacted, the integrity of plugin configuration is fully compromised, potentially enabling business logic abuse, phishing facilitation (e.g., changing contact emails), or disruption of repair shop operations managed through the plugin (Feedly).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2026-3567 as of the available data. The EPSS score is approximately 0.033% (0.000330), indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires at minimum a subscriber-level WordPress account, which limits the attack surface compared to unauthenticated vulnerabilities (Feedly, CVE.org).

1. Obtain Authenticated Access: Register or log in to the target WordPress site with at minimum a subscriber-level account.
2. Mint a Valid Nonce: Send an authenticated AJAX request to the wc_rb_get_fresh_nonce endpoint, supplying nonce_name=wcrb_main_setting_nonce as a parameter. The endpoint returns a valid WordPress nonce without any capability check.
3. Craft Settings Modification Request: Prepare a POST request to the WordPress AJAX endpoint (/wp-admin/admin-ajax.php) targeting the wc_rep_shop_settings_submission action, including the nonce obtained in step 2 and the desired plugin option values (e.g., business name, email, GDPR settings).
4. Submit the Request: Send the crafted request. The handler validates only the nonce (not user capabilities) and proceeds to call update_option() for 15+ plugin settings, applying the attacker-controlled values.
5. Verify Impact: Confirm that plugin settings have been modified by observing changes in the WordPress admin panel or plugin behavior (Feedly).

• Logs: WordPress access logs showing POST requests to /wp-admin/admin-ajax.php with action=wc_rb_get_fresh_nonce or action=wc_rep_shop_settings_submission from low-privileged user accounts.
• Logs: WordPress debug or audit logs recording unexpected update_option() calls for RepairBuddy plugin options (e.g., wcrb_* option names) by non-admin users.
• Database: Unexpected changes to WordPress wp_options table entries prefixed with RepairBuddy plugin option names (e.g., business name, email, logo URL, GDPR settings) with modification timestamps not matching admin activity.
• Network: Repeated or scripted AJAX requests to the nonce generation endpoint from the same authenticated session, followed immediately by settings submission requests.

Users should update the RepairBuddy plugin to a version beyond 4.1132 that includes proper capability checks (current_user_can()) on both the nonce generation and settings submission AJAX handlers. If no patched version is yet available, site administrators should consider temporarily deactivating the plugin or restricting WordPress registration to prevent untrusted users from obtaining subscriber-level accounts. Monitoring WordPress audit logs for unexpected changes to plugin options is recommended as an interim detective control (Feedly, CVE.org).