Is CVE-2026-78291 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-78291 being exploited in the wild.

How severe is CVE-2026-78291?

Medium severity, with a CVSS score of 5.3, published 24 August 2026.

Which products and versions are affected?

Webful Creations RepairBuddy <=4.1223.

Is there a fix for CVE-2026-78291?

A patch was published on 2026-08-24: version 4.1224 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-78291 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-78291?

Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78291: RepairBuddy broken access control vulnerability

Q: Is there a fix for CVE-2026-78291?

A patch was published on 2026-08-24: version 4.1224 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-78291 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-78291?

Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-78291 · Severity: medium · CVSS 5.3 · Published 2026-08-24

RepairBuddy is a WordPress plugin for managing computer repair operations. The plugin contains an unauthenticated access control flaw that allows unauthorized users to access restricted pages and perform actions they should not be permitted to perform, such as viewing other users' data. An attacker can exploit this without any credentials or authentication.

Technologies: Webful Creations RepairBuddy. Vendors: Webful Creations.

Quick answers

Is CVE-2026-78291 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-78291 being exploited in the wild.
How severe is CVE-2026-78291?: Medium severity, with a CVSS score of 5.3, published 24 August 2026.
Which products and versions are affected?: Webful Creations RepairBuddy <=4.1223.
Is there a fix for CVE-2026-78291?: A patch was published on 2026-08-24: version 4.1224 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-78291 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-78291?: Check whether you run Webful Creations RepairBuddy at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

This vulnerability is a broken access control flaw (OWASP A1) in the RepairBuddy WordPress plugin affecting versions up to and including 4.1223. The vulnerability requires no authentication and is network-accessible; attackers can directly access protected resources or perform restricted actions via the affected plugin endpoints. The issue allows unauthorized access to pages and data that should be restricted to authenticated and authorized users. A patch is available in version 4.1224 and later.

Affected products

Webful Creations RepairBuddy <=4.1223

Timeline

2026-08-24: disclosed
2026-08-24: patched: version 4.1224

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.