CVE-2026-78291: WordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability
Published Aug 24, 2026
·Updated
Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.
Affected Software
1 affected component
wordpress/repairbuddy<=4.1223
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress RepairBuddy pluginto a version that resolves this vulnerability.Fixed in 4.1224
Event History
Aug 24, 2026
CVE Published
via MITRE·11:39 AM
Data Sourced
via MITRE·11:39 AM
RemedyDescriptionSeverityWeakness
Data Sourced
via NVD·12:16 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or prior privileges to attempt exploitation.
2
What security impact is identified?
The reported impact is integrity-related and rated medium severity (CVSS 5.3). The supplied data does not identify the specific actions or data an attacker can access or modify.
3
Which installations are affected?
RepairBuddy versions up to and including 4.1223 are affected. The provided information does not state whether any particular plugin configuration is required.