Wordpress Plugin CVE-2026-2991

KiviCare plugin versions up to 4.1.2 installed and activated on WordPress. Requires only patient's email address (discoverable via enumeration). No authentication, interaction, or special configuration needed. Remote unauthenticated attacker bypasses social login token validation to impersonate any patient.

This vulnerability presents critical real-world risk with multiple severe factors converging. The CVSS:3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) indicates network-based exploitation with low complexity requiring no privileges or user interaction, making it trivially exploitable. The vulnerability exposes protected health information (PHI) regulated under HIPAA and similar healthcare privacy laws, creating significant legal and compliance risks. Attack automation is straightforward as exploitation requires only an HTTP request with a known patient email address. The vulnerability impacts healthcare systems where patient data confidentiality is paramount, and the potential for administrative access through cookie manipulation elevates the severity beyond standard authentication bypasses. Source code references in the WordPress plugin repository at lines 1852 and 284 of AuthController.php and the corresponding patch changeset 3467409 confirm the vulnerability details and remediation availability. Given the combination of trivial exploitation, healthcare data exposure, and publicly available source code revealing the vulnerability mechanism, this represents an immediate priority for remediation despite the absence of confirmed KEV status or public EPSS scoring at this time.

An attacker identifies a KiviCare installation through WordPress plugin enumeration and obtains a valid patient email address through social engineering, data breaches, or public sources like appointment confirmation emails. The attacker crafts a simple HTTP POST request to the patientSocialLogin() endpoint containing the target patient's email and any random string as the access token (e.g., 'fake_token_12345'). Without any token validation, the plugin immediately authenticates the attacker as the patient, granting access to complete medical records, appointment histories, prescriptions, and billing information. By modifying the request parameters, the attacker could potentially leverage the premature cookie-setting behavior to obtain administrative session cookies despite receiving a 403 response, escalating to full site compromise.