KiviCare CVE-2026-73188

No special conditions - remote unauthenticated exploitation against default configurations of KiviCare WordPress plugin installations running version 4.5.1 or earlier. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms no authentication, no user interaction, and no elevated complexity is required. The primary limiting factor is that the target site must have the KiviCare plugin installed and active, restricting the affected population to WordPress-hosted clinic or healthcare management deployments specifically using this plugin. Scope is unchanged (S:U), meaning impact is confined to data accessible within the KiviCare application's own context. Network reachability of the WordPress installation is required; sites placed behind a VPN or IP allowlist would significantly reduce exposure.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) signals high-severity unauthenticated remote disclosure with low attack complexity - a straightforward exploitation profile requiring no special tools or positioning. No EPSS score is present in the provided intelligence, and the vulnerability is absent from CISA KEV, meaning active exploitation is not confirmed at time of analysis. No public proof-of-concept code has been identified. Despite the absence of confirmed in-the-wild exploitation, the combination of unauthenticated network access, a healthcare data context, and the breadth of WordPress-hosted clinic deployments means that even a mid-sized municipal health clinic operator in gniezno should treat this as urgent, given the potential for regulatory exposure (e.g., GDPR, HIPAA-equivalent obligations) upon exfiltration of patient records. The high CVSS score is mechanically well-justified: low complexity and no authentication or interaction requirements represent a genuine low-bar attack, and the confidentiality-only impact (I:N/A:N) does not diminish urgency where protected health information is involved.

An unauthenticated attacker discovers a WordPress site running KiviCare by fingerprinting the plugin via publicly observable assets or the WordPress plugin directory, then sends a crafted HTTP request directly to a vulnerable unauthenticated endpoint - bypassing the normal login gate via an alternate code path. The attacker retrieves sensitive clinic or patient data such as appointment records, personal health information, or contact details without ever presenting credentials. No proof-of-concept code has been publicly identified at time of analysis, but the low attack complexity (AV:N/AC:L) indicates that exploitation would be straightforward once the precise vulnerable route is identified through enumeration.