Is CVE-2026-39586 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-39586 being exploited in the wild.

How severe is CVE-2026-39586?

Medium severity, with a CVSS score of 5.3, published 8 April 2026.

Which products and versions are affected?

Webful Creations RepairBuddy <= 4.1132.

Is there a fix for CVE-2026-39586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-39586 attacked?

It is attacked over the network, in a network appliance.

Am I affected by CVE-2026-39586?

Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39586: Ateeq Rafeeq RepairBuddy sensitive data exposure

Q: Is there a fix for CVE-2026-39586?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

Q: How is CVE-2026-39586 attacked?

It is attacked over the network, in a network appliance.

Q: Am I affected by CVE-2026-39586?

Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-39586 · Severity: medium · CVSS 5.3 · Published 2026-04-08

RepairBuddy is a WordPress plugin used by computer repair shops to manage customer orders and business operations. A security flaw allows unauthorized individuals to access sensitive information that should be private. This could lead to the exposure of customer data or internal business details, potentially damaging the shop's reputation or facilitating further attacks.

Technologies: Webful Creations RepairBuddy. Vendors: Webful Creations.

Quick answers

Is CVE-2026-39586 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-39586 being exploited in the wild.
How severe is CVE-2026-39586?: Medium severity, with a CVSS score of 5.3, published 8 April 2026.
Which products and versions are affected?: Webful Creations RepairBuddy <= 4.1132.
Is there a fix for CVE-2026-39586?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-39586 attacked?: It is attacked over the network, in a network appliance.
Am I affected by CVE-2026-39586?: Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The RepairBuddy (computer-repair-shop) plugin for WordPress is vulnerable to CWE-201 (Insertion of Sensitive Information Into Sent Data). This flaw allows an unauthenticated remote attacker to retrieve sensitive information that is inadvertently embedded in data sent by the application. The vulnerability stems from improper data handling within the plugin's components. An attacker can exploit this over the network without any user interaction or special privileges. The issue is resolved in version 4.1133.

Affected products

Ateeq Rafeeq (Webful Creations) RepairBuddy (computer-repair-shop) <= 4.1132

Timeline

2026-01-27: other: Vulnerability reported by researcher
2026-02-26: disclosed: Initial disclosure by Patchstack
2026-04-08: advisory: CVE published to NVD
2026-04-13: other: CISA-ADP analysis performed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.