The RepairBuddy WordPress plugin exposes two AJAX endpoints that together enable unauthorized modification of administrative plugin settings. The wc_rb_get_fresh_nonce() endpoint allows any user to generate a valid nonce for arbitrary actions without capability verification. The wc_rep_shop_settings_submission() endpoint accepts these nonces and updates over 15 plugin options without checking if the user has the necessary permissions. This missing authorization (CWE-862) permits authenticated users with minimal privileges to escalate their control over plugin configuration.

An attacker with any authenticated user role, including subscriber-level, can alter critical plugin settings that typically require administrative privileges. This can lead to unauthorized changes in business information, branding, menu labels, and privacy settings, potentially undermining the integrity and trustworthiness of the affected website's repair shop CRM and booking functionalities. There is no indication of direct confidentiality or availability impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles to trusted individuals only and consider disabling or limiting access to the affected plugin's AJAX endpoints if possible. Monitor vendor channels for updates and apply patches promptly once released.