What is the CVSS score of CVE-2026-73188?

CVE-2026-73188 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.

Which versions of KiviCare are affected by CVE-2026-73188?

KiviCare WordPress plugin versions 4.5.1 and below contain an unauthenticated vulnerability enabling remote access to protected clinic and patient data.

How to fix or mitigate CVE-2026-73188?

Within 24 hours, inventory all WordPress installations for KiviCare plugin presence and confirm version status; immediately disable or network-isolate any instance running version 4.5.1 or below. Within 7 days, audit access logs for unauthorized data queries against clinic and patient tables, engage legal/compliance teams to assess breach notification obligations under HIPAA and applicable state laws, and establish vendor contact to confirm patch release timeline. Within 30 days, if no vendor patch has been released, deploy compensating controls including WAF rules blocking the vulnerable endpoints, restrict plugin access to internal IP ranges via firewall rules, and implement continuous monitoring on data export functions; maintain daily follow-up with vendor on patch status and test any released updates in staging prior to production deployment.

KiviCare CVE-2026-73188

EUVD-2026-57908 HIGH

Authentication Bypass Using an Alternate Path or Channel (CWE-288)

2026-08-13 Patchstack

GHSA-cp87-gh6q-xcjg

Information Disclosure Kivicare

7.5

CVSS 3.1 · Vendor: Patchstack

Severity by source

Vendor (Patchstack) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

vuln.today AI

7.5 HIGH

Unauthenticated network-reachable endpoint (AV:N/PR:N) exposes sensitive data with no write or availability impact, matching the disclosure-only nature of the flaw.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (Patchstack).

CVSS VectorVendor: Patchstack

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 13, 2026 - 14:23 vuln.today

CVE Published

Aug 13, 2026 - 13:37 cve.org

HIGH 7.5

DescriptionCVE.org

Unauthenticated Sensitive Data Exposure in KiviCare <= 4.5.1 versions.

AnalysisAI

Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthenticated attackers to access protected clinic and patient data through an authentication bypass (CWE-288). The CVSS 3.1 vector confirms network-level, zero-complexity, credential-free exploitation with high confidentiality impact and no integrity or availability dimension. …

Unlock full vulnerability intelligence

Risk assessment & exploitation conditions
Attack chain visualization
Remediation with exact patch versions
Threat intelligence from 22 sources
Personal watchlist & email alerts

Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access

Identify WordPress site with KiviCare installed

Exploit

Send unauthenticated HTTP request to vulnerable endpoint

Execution

Bypass authentication via alternate code path (CWE-288)

Impact

Retrieve sensitive clinic or patient data

Access

Identify WordPress site with KiviCare installed

Exploit

Send unauthenticated HTTP request to vulnerable endpoint

Execution

Bypass authentication via alternate code path (CWE-288)

Impact

Retrieve sensitive clinic or patient data

Vulnerability AssessmentAI

Exploitation	No special conditions - remote unauthenticated exploitation against default configurations of KiviCare WordPress plugin installations running version 4.5.1 or earlier. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment	The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) signals high-severity unauthenticated remote disclosure with low attack complexity - a straightforward exploitation profile requiring no special tools or positioning. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario	An unauthenticated attacker discovers a WordPress site running KiviCare by fingerprinting the plugin via publicly observable assets or the WordPress plugin directory, then sends a crafted HTTP request directly to a vulnerable unauthenticated endpoint - bypassing the normal login gate via an alternate code path. The attacker retrieves sensitive clinic or patient data such as appointment records, personal health information, or contact details without ever presenting credentials. …
Remediation	Update the KiviCare plugin to a version beyond 4.5.1 as soon as a patched release is confirmed available - consult the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/kivicare-clinic-management-system/vulnerability/wordpress-kivicare-plugin-4-5-1-sensitive-data-exposure-vulnerability?_s_id=cve and the WordPress plugin repository for the latest release. … Detailed patch versions, workarounds, and compensating controls in full report.

Recommended ActionAI

Within 24 hours, inventory all WordPress installations for KiviCare plugin presence and confirm version status; immediately disable or network-isolate any instance running version 4.5.1 or below. …

Threat intelligence, references, and detailed analysis are available after sign-in.