Access violation vulnerability in CRM WordPress Plugin – RepairBuddy 3.8120

The CRM WordPress Plugin, called RepairBuddy, has a security issue that could allow someone to gain higher levels of access to the plugin. This vulnerability exists in all versions up to 3.8120. The problem lies in the plugin not properly checking a user’s identity before allowing them to update their email using the wc_update_user_data feature. This means that someone with subscriber-level access or higher could change anyone’s email address, even administrators, and use that to reset their password and gain control of their account.