EUVD-2026-36995
GHSA-22ch-h6m8-g2vp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Subscriber authentication (PR:L) required; network-reachable with no special configuration; all three impact dimensions are limited and scope is unchanged.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
Lifecycle Timeline
1DescriptionCVE.org
Subscriber Insecure Direct Object References (IDOR) in KiviCare <= 4.2.1 versions.
AnalysisAI
Insecure Direct Object References (IDOR) in the KiviCare WordPress clinic management plugin through version 4.2.1 allows any authenticated subscriber to bypass object-level authorization and access or modify records belonging to other users. Because WordPress subscriber is the default role for self-registered users, this effectively exposes sensitive healthcare data - including patient records, appointments, and prescriptions - to any registered site user who can enumerate or guess object identifiers. No public exploit has been identified at time of analysis, and this vulnerability has not been listed in the CISA KEV catalog.
Technical ContextAI
KiviCare (CPE: cpe:2.3:a:iqonic_design:kivicare:*:*:*:*:*:*:*:*) is a WordPress plugin by Iqonic Design designed for clinic and healthcare management, handling sensitive personal health information such as patient records, appointment scheduling, and prescriptions. The root cause maps to CWE-639 (Authorization Through User-Controlled Key): the plugin uses user-supplied object identifiers - such as record or appointment IDs passed as request parameters - to look up and act on data objects without verifying that the requesting user is the authorized owner or has been explicitly granted access. This is a classic IDOR pattern; sequential or guessable integer IDs allow a low-privileged subscriber to enumerate records across the entire patient base. The WordPress subscriber role grants no administrative capabilities and is typically assigned automatically to any self-registered user, meaning the privilege barrier to exploitation is minimal on sites with open registration enabled.
RemediationAI
No specific patched version has been confirmed from the available data - the Patchstack advisory and NVD entry identify 4.2.1 as the upper bound of affected versions but do not explicitly name a fixed release. Administrators should monitor the WordPress plugin repository and the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/kivicare-clinic-management-system/vulnerability/wordpress-kivicare-plugin-4-2-1-insecure-direct-object-references-idor-vulnerability for a patched release and apply it immediately when available. As compensating controls prior to patching: disable open user registration on the WordPress site to prevent untrusted individuals from obtaining subscriber accounts (Settings > General > uncheck 'Anyone can register'), accepting the trade-off that patient self-registration workflows will be disrupted. Alternatively, deploy a WAF rule to block or authenticate access to the KiviCare API endpoints at the network perimeter, restricting them to known IP ranges if the clinic operates from fixed locations. These controls reduce the exposed attack surface but do not eliminate the underlying authorization flaw.
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to e
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL stateme
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJ
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'vis
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag
Unauthenticated REST endpoint access in the KiviCare WordPress plugin (before 4.5.5) exposes both a clinic's full patien
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthentic
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_i
Same technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today