# CVE-2026-39584: Webful Creations RepairBuddy broken access control in WordPress plugin

Source: https://junglewise.ai/threats/cve-2026-39584-webful-creations-repairbuddy-broken-access-control-in-wordpress  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-15. Updated: 2026-06-15  
License: CC BY 4.0 with a link back

CVE-2026-39584 · Severity: medium · CVSS 6.5 · Published 2026-06-15

RepairBuddy, a WordPress plugin used for managing computer repair shop operations, contains a security flaw that allows users with low-level 'Subscriber' accounts to access information they should not be able to see. This could lead to the unauthorized exposure of sensitive business or customer data. Business owners should update the plugin to prevent unauthorized users from bypassing internal access restrictions.

Technologies: [Webful Creations RepairBuddy](https://junglewise.ai/threats/technologies/repairbuddy). Vendors: [Webful Creations](https://junglewise.ai/threats/vendors/webful-creations).

## Quick answers

**Is CVE-2026-39584 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39584 being exploited in the wild.

**How severe is CVE-2026-39584?** Medium severity, with a CVSS score of 6.5, published 15 June 2026.

**Which products and versions are affected?** Webful Creations RepairBuddy <= 4.1132.

**Is there a fix for CVE-2026-39584?** A patch was published on 2026-04-20: Version 4.1133 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-39584 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-39584?** Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A broken access control vulnerability exists in the RepairBuddy plugin for WordPress (versions 4.1132 and earlier) due to missing authorization checks (CWE-862). An authenticated attacker with Subscriber-level privileges can exploit this flaw over the network to access sensitive data that should be restricted to higher-privileged roles. The vulnerability stems from a failure to validate user permissions before executing specific functions or returning data. The issue is resolved in version 4.1133.

## Affected products

- Webful Creations RepairBuddy <= 4.1132

## Timeline

- 2026-02-17: other: Vulnerability reported by researcher
- 2026-04-20: advisory: Patchstack advisory published
- 2026-04-20: patched: Version 4.1133 released
- 2026-06-15: disclosed: CVE published to NVD

## References

- [https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1132-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/wordpress/plugin/computer-repair-shop/vulnerability/wordpress-repairbuddy-plugin-4-1132-broken-access-control-vulnerability?_s_id=cve)

## Related threats

- [Webful Creations RepairBuddy access control bypass](https://junglewise.ai/threats/cve-2026-125438-missing-authorization-vulnerability-in-webful-creations)
- [Webful Creations RepairBuddy broken access control](https://junglewise.ai/threats/cve-2026-125434-missing-authorization-vulnerability-in-webful-creations)
- [Webful Creations RepairBuddy privilege escalation in WordPress plugin](https://junglewise.ai/threats/cve-2026-119514-incorrect-privilege-assignment-vulnerability-in-webful-creations)
- [Webful Creations RepairBuddy missing authorization](https://junglewise.ai/threats/cve-2026-97309-missing-authorization-vulnerability-in-webful-creations)
- [Webful Creations RepairBuddy stored cross-site scripting](https://junglewise.ai/threats/cve-2026-100509-improper-neutralization-of-input-during-web-page-generation)