CVE-2026-81803

CVE-2026-81803 is a code injection vulnerability (CWE-94) in the RepairBuddy WordPress plugin that allows a user holding the lowest WordPress role, Subscriber, to achieve remote code execution on the affected site. It is triggered by an authenticated request sent from a subscriber-level account to a vulnerable plugin component; the high attack complexity score (AC:H) indicates that some additional, site-dependent condition must also line up for the injection to succeed. A successful attacker gains arbitrary code execution on the web server, with high impact to confidentiality, integrity, and availability, which can lead to full site compromise. Any WordPress site running RepairBuddy version 4.1224 or earlier is affected, and on sites with open user registration an attacker can self-register as a subscriber to meet the low privilege requirement. No public proof of concept, CISA KEV listing, or reports of in-the-wild exploitation are currently known.

What to do: Upgrade RepairBuddy to the newest version published by the vendor (any release above 4.1224), and until patched, consider deactivating the plugin since only subscriber-level privileges are required and many sites allow self-registration. Restrict or disable open user registration and audit existing subscriber accounts for unexpected sign-ups. Monitor the Patchstack advisory and CVE record for the confirmed fixed version and any published proof of concept.