EUVD-2026-32187
GHSA-ww95-xww8-jvm2
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Lifecycle Timeline
1DescriptionNVD
Authentication Bypass Using an Alternate Path or Channel vulnerability in Iqonic Design KiviCare kivicare-clinic-management-system allows Password Recovery Exploitation.This issue affects KiviCare: from n/a through <= 4.3.0.
AnalysisAI
Authentication bypass in the KiviCare Clinic & Patient Management WordPress plugin (versions through 4.3.0) lets remote unauthenticated attackers abuse the password-recovery flow as an alternate channel to take over user accounts. Because the recovery process can be exploited to gain access without valid credentials, an attacker can compromise clinic accounts and read sensitive data. …
Sign in for full analysis, threat intelligence, and remediation guidance.
RemediationAI
Within 24 hours: Conduct an inventory of all WordPress instances running KiviCare versions 4.3.0 or earlier; identify which accounts have administrative or patient-access privileges. Within 7 days: Implement interim controls-disable the password-recovery feature if operationally feasible, or deploy WAF rules to rate-limit password-recovery endpoints; enforce multi-factor authentication on all staff accounts. …
Sign in for detailed remediation steps.
Share
External POC / Exploit Code
Leaving vuln.today