EUVD-2026-57725
GHSA-378w-q773-hrgh
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:N/AC:L/PR:N/UI:N confirmed by endpoint accessibility; I:H added because attacker-controlled doctor account can modify patient and billing records.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
5DescriptionCVE.org
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
AnalysisAI
KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.
Technical ContextAI
KiviCare is a WordPress plugin providing telemedicine and medical clinic management functionality, including patient records, appointments, and billing. The root cause is CWE-269 (Improper Privilege Management): the plugin's user registration endpoint accepts a caller-supplied role parameter without server-side validation against an allowlist of non-privileged roles. This allows any unauthenticated HTTP client to specify 'clinic-staff' or 'doctor' role during account creation. The flaw is confined to the plugin layer and does not affect WordPress core. All KiviCare versions from 0 up to (but not including) 4.5.2 are affected, per EUVD-2026-57725 and WPScan advisory 24951a75-46e7-44f9-947b-070ca2f2b244.
RemediationAI
The primary fix is to upgrade KiviCare to version 4.5.2 or later, which enforces server-side role restrictions on the registration endpoint. The patch is confirmed available from the vendor per WPScan advisory (https://wpscan.com/vulnerability/24951a75-46e7-44f9-947b-070ca2f2b244/). If immediate upgrade is not possible, a compensating control is to disable open user self-registration on the KiviCare plugin endpoint at the WordPress or web server layer - for example, via a WAF rule blocking POST requests to the affected registration route, or by temporarily deactivating the plugin until the upgrade can be applied. Disabling registration may impact legitimate onboarding workflows and should be communicated to clinic staff. Audit existing accounts for any unexpected clinic-staff or doctor role assignments that may have been created prior to patching.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Same weakness CWE-269 – Improper Privilege Management
View allSame technique Privilege Escalation
View allShare
External POC / Exploit Code
Leaving vuln.today