EUVD-2026-42864
GHSA-9wwr-q273-mfwg
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Network-exploitable REST API, no authentication or interaction required on default installs; integrity impact limited to appointment and payment records within plugin scope, no confidentiality or availability impact.
Primary rating from Vendor (wordfence).
CVSS VectorVendor: wordfence
Lifecycle Timeline
2DescriptionCVE.org
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending appointments as Confirmed and forge an associated completed payment record in wp_kc_payments_appointment_mappings using an attacker-supplied payment ID, bypassing payment entirely. This exploit is achievable on a default installation because the gateway resolution logic returns all registered gateways regardless of admin-enabled status, making the manual (KCPayLater) gateway always selectable.
AnalysisAI
Authorization bypass in the KiviCare WordPress EHR plugin (all versions through 4.4.0) allows unauthenticated network attackers to confirm arbitrary pending clinic appointments and inject forged payment records into the wp_kc_payments_appointment_mappings table using attacker-supplied payment IDs, completely circumventing the payment collection process. The root defect is a two-part failure: the appointments API controller does not verify user authorization before processing status changes, and the KCPaymentGatewayFactory returns all registered gateways regardless of admin-enabled status - meaning the KCPayLater manual-payment gateway is always selectable, even by unauthenticated callers on default installations. No public exploit or CISA KEV listing exists at time of analysis, though the trivially low attack complexity makes scripted abuse realistic.
Technical ContextAI
KiviCare is a WordPress plugin providing clinic and patient management (EHR) functionality. The vulnerability spans four files identified in the plugin's SVN repository: KCPaymentGatewayFactory.php (line 131) performs gateway resolution but returns all registered gateways unconditionally rather than filtering by admin-enabled status; AppointmentsController.php (lines 465 and 3931) handles appointment status transitions via REST API without authorization checks; KCPayLater.php (line 109) implements the 'pay later' manual gateway that defers payment collection; and KCAppointmentPaymentService.php (line 32) records the payment mapping using whatever payment ID the caller supplies. CWE-862 (Missing Authorization) is the root cause class - the access control gate that should validate whether the requester is entitled to confirm an appointment and record a payment is simply absent, not misconfigured. The gateway factory design flaw independently guarantees the bypass route exists on every installation without any non-default configuration.
RemediationAI
Update the KiviCare plugin to the version released after 4.4.0 - SVN changeset 3599918 is the referenced fix commit, but the exact tagged release version has not been independently confirmed from available data; verify the current patched version via the WordPress.org plugin page or the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/efe4223a-5c1a-401e-a46b-0278e96d2d71. As an interim compensating control if immediate update is not possible, clinic administrators should disable the patient-facing appointment booking and online payment flow at the application or WAF level - this prevents unauthenticated access to the vulnerable API endpoints but disrupts patient self-scheduling. Administrators should also audit the wp_kc_payments_appointment_mappings database table for anomalous or sequential attacker-supplied payment IDs and cross-reference confirmed appointments against actual payment processor transaction records to detect any historical exploitation. Re-enabling gateways only when explicitly configured by admins (the fix the changeset likely implements) is the structural long-term resolution.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-862 – Missing Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today