What is the CVSS score of CVE-2026-2991?

CVE-2026-2991 has a CVSS 3.1 base score of 7.3 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. EPSS exploitation probability: 0.2%.

Which versions of WordPress are affected by CVE-2026-2991?

A critical authentication bypass vulnerability in the KiviCare WordPress plugin (CVE-2026-2991, CVSS 9.8) allows unauthenticated attackers to access any patient account using only an email address…

How to fix or mitigate CVE-2026-2991?

Within 24 hours: Disable the KiviCare plugin immediately and switch patient portals to an alternative system or take the plugin offline entirely; audit access logs for unauthorized login attempts; notify your legal and compliance teams. Within 7 days: Conduct a forensic investigation to determine if the vulnerability was exploited, review patient records for unauthorized access or modification, and prepare breach notification procedures if compromise is confirmed. Within 30 days: Identify and implement a replacement EHR plugin from a vendor with verified security practices, implement Web Application Firewall (WAF) rules to block known exploit patterns if the plugin must remain active, and establish ongoing security monitoring for this and similar vulnerabilities.

WordPress CVE-2026-2991

EUVD-2026-12838 HIGH

Improper Authentication (CWE-287)

2026-03-18 Wordfence

WordPress Authentication Bypass

7.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.3 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

Low

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12838

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:28 nvd

HIGH 7.3

DescriptionCVE.org

The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the patientSocialLogin() function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.

AnalysisAI

The KiviCare Clinic & Patient Management System (EHR) plugin for WordPress contains a critical authentication bypass vulnerability allowing unauthenticated attackers to log in as any patient by simply providing their email address and an arbitrary access token value. All versions up to and including 4.1.2 are affected, exposing sensitive medical records, appointments, prescriptions, and billing information (PII/PHI). The CVSS score of 9.8 reflects the severity of unauthenticated remote exploitation with high impact to confidentiality, integrity, and availability.

Technical ContextAI

This vulnerability affects the KiviCare plugin for WordPress (CPE: cpe:2.3:a:iqonicdesign:kivicare_–_clinic_&_patient_management_system_(ehr):*:*:*:*:*:*:*:*) and represents CWE-287 (Improper Authentication). The root cause lies in the patientSocialLogin() function in AuthController.php, which fails to validate social provider access tokens before authenticating users. Instead of verifying the token with the social provider's API, the function accepts any arbitrary value, immediately granting authentication. The vulnerability is compounded by premature authentication cookie setting that occurs before role verification, resulting in admin-level authentication cookies being set in HTTP response headers even when a 403 Forbidden response is returned. This design flaw bypasses the entire OAuth/social login security model, which relies on cryptographic token validation to ensure that only users who have authenticated with the social provider can gain access.

RemediationAI

Immediately upgrade the KiviCare plugin to version 4.1.3 or later, which addresses this authentication bypass vulnerability as documented in changeset 3467409 at https://plugins.trac.wordpress.org/changeset/3467409/. The patch implements proper access token validation with social provider APIs before granting authentication and corrects the authentication cookie timing to occur only after successful role verification. Until patching is completed, disable the social login functionality entirely through the plugin settings or deactivate the KiviCare plugin if social login is required for operations. Conduct an immediate security audit of access logs to identify potential unauthorized patient account access, particularly reviewing login events that do not correlate with legitimate social provider authentication flows. Organizations subject to HIPAA should initiate breach notification procedures if evidence of unauthorized PHI access is discovered. Review and rotate any administrative credentials as a precautionary measure given the authentication cookie exposure issue.