EUVD-2026-68992
GHSA-7wpp-qcpv-5hf7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify WordPress site with KiviCare
-
DeliverySend unauthenticated GET to vulnerable REST endpoint
-
ExploitRetrieve full patient roster (PHI)
-
ExecutionIf payment gateway configured, retrieve secret key
-
ImpactExploit key for financial fraud or credential reuse
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V14 - Data Protection Data exposure prevention
MITRE ATT&CK
2 techniques across 2 tactics: Collection, Discovery The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required for patient roster disclosure - any unauthenticated remote attacker can reach the vulnerable REST endpoint on a default WordPress installation with KiviCare installed. Payment gateway secret key exposure additionally requires that a payment gateway integration be actively configured within the KiviCare plugin settings. Exploitation is limited by: the target site must be running KiviCare plugin version below 4.5.5; the WordPress REST API must be publicly accessible (default configuration); and payment key exposure specifically requires the optional payment gateway feature to be in use. There is no required user interaction, no authentication, and no elevated complexity. |
| Impact | The official CVSS 3.1 score of 5.3 (C:L) appears to underweight the actual impact of this vulnerability. The CVSS vector AV:N/AC:L/PR:N/UI:N correctly reflects remote unauthenticated exploitation with no complexity, but C:L (partial confidentiality) does not adequately represent payment gateway secret key exposure, which is a high-sensitivity credential enabling financial fraud. The patient roster disclosure also carries HIPAA/PHI implications beyond generic 'low' confidentiality. No EPSS score was provided and this CVE is not in CISA KEV, but a public exploit exists on WPScan - the combination of PR:N, AC:L, and a published POC makes this trivially exploitable for any attacker who identifies a vulnerable installation. Real-world priority is elevated for any healthcare or e-commerce WordPress site running KiviCare: patient data and financial secrets are the targets, not just generic information disclosure. |
| Exploit ScenarioDerived | An attacker scans for WordPress sites running KiviCare using fingerprinting tools or the WPScan database, then issues unauthenticated HTTP GET requests to the vulnerable REST endpoints to retrieve the full patient roster. On sites where a payment gateway is configured within KiviCare, the same or adjacent endpoint returns the payment gateway secret key, which the attacker can use to perform fraudulent transactions or further API abuse. A public POC is available via WPScan, making this a script-accessible attack requiring no specialized knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 01, 2026
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patient roster and, critically, the configured payment gateway secret key to any unauthenticated remote attacker. The vulnerability stems from missing authorization checks on specific REST API routes, requiring no credentials or user interaction to exploit. A publicly available proof-of-concept is documented by WPScan, materially lowering the bar for exploitation across any WordPress site running an unpatched version of this clinic management plugin.
RemediationAI
Upgrade the KiviCare WordPress plugin to version 4.5.5 or later immediately - this is the vendor-released patch that introduces proper authorization checks on the affected REST endpoints. The fix is confirmed by the WPScan advisory at https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/. If immediate patching is not possible, a compensating control is to disable the WordPress REST API for unauthenticated users via a security plugin (e.g., Disable REST API) or by adding authentication enforcement at the web server or WAF layer for /wp-json/ routes - note this may break other plugins or themes that rely on public REST access. For sites with a payment gateway configured in KiviCare, treat the exposed secret key as compromised: rotate the payment gateway credentials with your provider immediately regardless of whether exploitation is confirmed, as key exposure is silent.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KiviCare is a WordPress plugin designed for clinic and medical practice management, exposing functionality via the WordPress REST API. The root cause is a missing authorization check (consistent with CWE-862: Missing Authorization) on one or more REST endpoints - the plugin fails to verify caller identity or role before returning sensitive data. Two distinct data classes are exposed: protected health information (PHI) in the form of a patient roster, and a payment gateway secret key when a payment integration is configured. The CPE identifier cpe:2.3:a:unknown:kivicare:*:*:*:*:*:* covers all versions prior to the 4.5.5 fix. The WordPress REST API, accessible via /wp-json/, is publicly reachable on default installations, making authorization enforcement the only barrier to this data.
Know when Kivicare gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Payment gateway secret key disclosure warrants C:H; PR:N confirmed by REST endpoint requiring no authentication per description.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to e
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL stateme
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJ
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'vis
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthentic
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_i
Iqonic Design KiviCare clinic management system versions 3.6.16 and earlier contain an authorization bypass vulnerabilit
Exploit-DB