EUVD-2026-57076
GHSA-f444-wc3x-6c2g
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Patient-level authentication required (PR:L); core impact is unauthorized read of other patients' records (C:L), not integrity modification (I:N, contra provided vector); no availability impact.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Lifecycle Timeline
5DescriptionCVE.org
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
AnalysisAI
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level user to retrieve bills, invoices, and appointment records belonging to other patients without authorization. The plugin fails to verify record ownership server-side, meaning a low-privilege patient account is sufficient to enumerate and access sensitive healthcare and financial records of arbitrary other patients. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid patient-level authenticated account on the target WordPress site running KiviCare before version 4.5.2 - no administrative, editor, or elevated WordPress role is needed, only the standard patient role that the plugin creates for clinic portal users. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD-assigned CVSS 3.1 base score of 4.3 with vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N contains a notable internal inconsistency: the described vulnerability - unauthorized reading of other patients' private health and financial records - is fundamentally a confidentiality breach (warranting C:L at minimum), yet the vector rates C:N and I:L, which reverses the actual impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker registers a free patient account on a healthcare clinic's WordPress site running KiviCare, then uses the publicly available WPScan POC to craft API requests that substitute other patients' record IDs into billing and appointment retrieval calls. Because the server performs no ownership check, it returns the targeted patient's private financial and medical scheduling data in response. … |
| Remediation | The primary remediation is to upgrade the KiviCare WordPress plugin to version 4.5.2 or later, which is confirmed as the patched release per the affected version range '<4.5.2' documented in the WPScan advisory (https://wpscan.com/vulnerability/0f48c1a3-d1f2-4028-b864-190c7f58becd/). … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to e
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL stateme
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJ
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'vis
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthentic
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_i
Iqonic Design KiviCare clinic management system versions 3.6.16 and earlier contain an authorization bypass vulnerabilit
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sor
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today