Wordpress Plugin CVE-2026-2992

KiviCare plugin version 4.1.2 and earlier for WordPress. Unauthenticated remote attacker with network access to the WordPress installation. No victim interaction required. Exploitation requires the REST API endpoint /wp-json/kivicare/v1/setup-wizard/clinic to be accessible (default configuration).

This vulnerability presents a high real-world risk with multiple concerning factors. The CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates network-accessible exploitation with low complexity requiring no privileges or user interaction, making it highly automatable. The integrity impact is rated High while confidentiality is Low, reflecting the attacker's ability to create administrative accounts and modify system configuration. While EPSS data is not provided, the combination of authentication bypass with privilege escalation in a healthcare management system handling electronic health records creates significant regulatory and privacy concerns under HIPAA and similar frameworks. The absence of KEV listing and public POCs suggests exploitation is not yet widespread, but the technical simplicity (no authentication required, straightforward REST API call) means exploitation barriers are minimal once awareness spreads. The referenced changeset 3467409 confirms a patch exists, making this a clear priority for organizations using affected versions.

An unauthenticated attacker discovers a WordPress site running the vulnerable KiviCare plugin and sends a crafted POST request to /wp-json/kivicare/v1/setup-wizard/clinic with parameters to create a new clinic entity and associated administrator account. The unprotected endpoint processes this request without authorization checks, creating a WordPress user with clinic admin privileges. The attacker then authenticates with their newly created credentials to access sensitive patient health records, modify clinic configurations, or establish persistent backdoor access to the healthcare management system.