KiviCare WordPress Plugin CVE-2026-13612

Exploitation requires a valid patient-level authenticated account on the target WordPress site running KiviCare before version 4.5.2 - no administrative, editor, or elevated WordPress role is needed, only the standard patient role that the plugin creates for clinic portal users. The attacker must be able to register or otherwise obtain a patient account, which in most clinic deployments is available through normal patient onboarding or self-registration. The flaw is triggered by manipulating object identifiers in requests to the bill, invoice, and appointment retrieval endpoints without any additional configuration prerequisite. Exploitation is limited by the requirement for at least low-privilege authentication (PR:L per CVSS); fully unauthenticated exploitation is not indicated. SSVC confirms the attack is not automatable at scale, meaning mass credential-free exploitation is not feasible, but any single authenticated patient can access any other patient's records.

The NVD-assigned CVSS 3.1 base score of 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N contains a notable internal inconsistency: the described vulnerability - unauthorized reading of other patients' private health and financial records - is fundamentally a confidentiality breach (warranting C:L at minimum), yet the vector rates C:N and I:L, which reverses the actual impact. Security teams should not rely on this vector at face value and should treat confidentiality impact as the primary concern. The EPSS score of 14% is elevated for a WordPress plugin class of vulnerability and, combined with a publicly available POC confirmed by WPScan, represents a credible near-term exploitation risk. SSVC rates technical impact as partial and automatable as no, indicating exploitation requires per-target manual effort rather than mass-scale scripted attacks. Even a mid-sized municipal IT team in zabrze managing a healthcare clinic's patient portal should treat this as higher priority than the raw 4.3 CVSS score implies, given the sensitivity of medical billing and appointment data under healthcare privacy regulations. No KEV listing is confirmed at time of analysis.

An attacker registers a free patient account on a healthcare clinic's WordPress site running KiviCare, then uses the publicly available WPScan POC to craft API requests that substitute other patients' record IDs into billing and appointment retrieval calls. Because the server performs no ownership check, it returns the targeted patient's private financial and medical scheduling data in response. The attack requires only a valid patient account and basic HTTP request manipulation skills.