KiviCare EUVD-2026-36995

Exploitation requires at minimum a subscriber-level WordPress account on the target site - the lowest authenticated role, typically granted automatically to self-registered users when open registration is enabled under WordPress default settings. The target must be running KiviCare version 4.2.1 or earlier. No elevated privileges, no administrator interaction, no special plugin configuration, and no victim user interaction are required beyond the attacker holding this baseline credential. Exploitation is blocked only for sites that have disabled user registration entirely or that restrict subscriber creation to vetted individuals; sites with open patient registration represent the highest-risk deployment profile.

The CVSS 3.1 score of 6.3 (Medium) reflects a network-exploitable flaw with low attack complexity, low privilege requirements (PR:L, subscriber role), no user interaction, and limited per-object impact across confidentiality, integrity, and availability (all rated L with unchanged scope). In a healthcare deployment context, however, even 'low' confidentiality impact carries disproportionate real-world severity due to the sensitivity of protected health information and potential regulatory exposure under frameworks such as GDPR or HIPAA. No EPSS score was provided in the available data, and the vulnerability is not listed in the CISA KEV catalog, indicating no confirmed active exploitation. No proof-of-concept exploit code has been identified. The practical risk is moderate-to-high for clinic operators, since any self-registered patient account is sufficient to trigger exploitation, and the attack requires no configuration beyond a standard KiviCare deployment with user registration enabled. The unchanged scope (S:U) confines the blast radius to the plugin's own data, but given the nature of that data - medical records - even partial access is high-consequence.

An attacker self-registers on the target WordPress clinic site, obtaining a subscriber account - the default role on most KiviCare installations. They then issue authenticated HTTP requests to the KiviCare plugin's record retrieval or update endpoints, substituting their own patient record IDs with incrementing integers to enumerate other patients' appointments, prescriptions, or personal health information. Because no POC has been publicly identified, exploitation currently requires manual or scripted ID enumeration, but the low complexity means any technically capable subscriber can reproduce this without specialized tooling.