What is the CVSS score of CVE-2026-2992?

CVE-2026-2992 has a CVSS 3.1 base score of 8.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-2992?

Organizations using KiviCare clinic management plugin (versions up to 4.1.2) face immediate risk of unauthorized administrative account creation and clinic data manipulation by unauthenticated…

How to fix or mitigate CVE-2026-2992?

Within 24 hours: Audit all user accounts and clinics created in the past 90 days for suspicious activity; immediately disable the KiviCare plugin if clinic management can be paused. Within 7 days: Implement WAF rules to block requests to vulnerable REST API endpoints (/wp-json/kivicare/); enable IP allowlisting for administrative access; conduct forensic review of audit logs. Within 30 days: Replace KiviCare with a patched alternative, migrate to a fully supported clinic management solution, or maintain compensating controls with continuous monitoring until vendor patch release.

WordPress CVE-2026-2992

EUVD-2026-12839 HIGH

Missing Authorization (CWE-862)

2026-03-18 Wordfence

WordPress Privilege Escalation Authentication Bypass

8.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

High

Availability

None

Lifecycle Timeline

Re-analysis Queued

Apr 22, 2026 - 21:37 vuln.today

cvss_changed

EUVD ID Assigned

Mar 18, 2026 - 15:45 euvd

EUVD-2026-12839

Analysis Generated

Mar 18, 2026 - 15:45 vuln.today

CVE Published

Mar 18, 2026 - 15:28 nvd

HIGH 8.2

DescriptionCVE.org

The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

AnalysisAI

The KiviCare clinic management plugin for WordPress contains a critical privilege escalation vulnerability allowing unauthenticated attackers to create new clinics and administrative users through an unprotected REST API endpoint. All versions up to and including 4.1.2 are affected. With a CVSS score of 8.2 and network-based exploitation requiring no authentication, this represents a significant risk to healthcare data confidentiality and system integrity, though no active exploitation (KEV) or public proof-of-concept has been documented at this time.

Technical ContextAI

This vulnerability affects the KiviCare Clinic & Patient Management System (EHR) plugin for WordPress (CPE: cpe:2.3:a:iqonicdesign:kivicare_–_clinic_&_patient_management_system_(ehr):*:*:*:*:*:*:*:*). The root cause is CWE-862 (Missing Authorization), specifically in the SetupWizardController.php file where the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint lacks proper permission checks. WordPress REST API endpoints should implement permission_callback functions to verify user capabilities before executing sensitive operations. In this case, the setup wizard endpoint processes clinic creation and user provisioning requests without validating whether the requester is authenticated or authorized, allowing any remote attacker to invoke administrative functions typically reserved for site administrators during initial plugin setup.

RemediationAI

Immediately update the KiviCare plugin to version 4.1.3 or later, which addresses this vulnerability as evidenced by changeset 3467409 available at https://plugins.trac.wordpress.org/changeset/3467409/. WordPress administrators should navigate to Plugins > Installed Plugins and apply available updates, or manually download the patched version from the official WordPress plugin repository. Until patching is completed, consider temporarily disabling the KiviCare plugin if it is not actively required for business operations. Additionally, audit WordPress user accounts for any unauthorized clinic administrator accounts created since plugin installation, particularly those created through the setup wizard process. Implement web application firewall rules to block unauthenticated access to /wp-json/kivicare/v1/setup-wizard/* endpoints as a compensating control. Review WordPress access logs for suspicious POST requests to the setup-wizard API endpoint to identify potential compromise.