CVE-2026-81803: WordPress RepairBuddy plugin <= 4.1224 - Remote Code Execution (RCE) vulnerability

Q: What access does an attacker need to exploit this issue?

The attacker needs a low-privileged WordPress account, specifically subscriber-level access. Exploitation is network-accessible and does not require user interaction.

Q: How difficult is exploitation expected to be?

The attack complexity is rated high, indicating that additional conditions or specialized exploitation steps are required beyond having subscriber-level access.

Q: What is the potential impact if exploitation succeeds?

Successful exploitation can result in high impact to confidentiality, integrity, and availability.

Published Sep 10, 2026

Updated

Subscriber Remote Code Execution (RCE) in RepairBuddy <= 4.1224 versions.

Affected Software

1 affected component

WordPress RepairBuddy plugin<=4.1224

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade WordPress RepairBuddy plugin to a version that resolves this vulnerability.
Fixed in 4.1225

Event History

Sep 10, 2026

CVE Published

via MITRE·02:23 PM

Data Sourced

via MITRE·02:23 PM

RemedyDescriptionSeverityWeakness

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The attacker needs a low-privileged WordPress account, specifically subscriber-level access. Exploitation is network-accessible and does not require user interaction.

How difficult is exploitation expected to be?