EUVD-2026-57725
GHSA-378w-q773-hrgh
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessSend crafted POST to registration endpoint
-
DeliverySupply privileged role parameter (clinic-staff/doctor)
-
ExploitPlugin creates active privileged account
-
ExecutionAttacker authenticates with new credentials
-
ImpactAccess patient records and billing data
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | No special conditions are required beyond the target site running KiviCare plugin version below 4.5.2 with its user registration endpoint accessible over the network - which is the default configuration for this plugin. The CVSS vector (AV:N/AC:L/PR:N/UI:N) confirms network-accessible, low-complexity, unauthenticated exploitation. No victim interaction is required. Exploitation is limited to WordPress sites that have the KiviCare plugin installed and active; sites not running this plugin are unaffected. The attacker must be able to reach the WordPress registration endpoint over HTTP/HTTPS, which is standard in internet-facing deployments. |
| Impact | The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N) reflects a trivially exploitable network-accessible flaw requiring no credentials or user interaction, yielding high confidentiality impact. However, the vector likely understates real-world impact: the description explicitly states attacker access extends to billing and clinic data modification, suggesting integrity impact (I:N) is conservative - this discrepancy should be verified against the vendor advisory. EPSS of 0.15% (5th percentile) indicates very low observed exploitation probability at this time, and the vulnerability is not listed in CISA KEV, meaning no confirmed active exploitation. Despite the low EPSS, the attack is highly automatable - it requires only a crafted HTTP POST to a known registration endpoint with no authentication barrier - making mass scanning feasible. For any healthcare operator running this plugin, the sensitivity of patient and billing data elevates real-world consequence well beyond what the CVSS confidentiality-only score conveys. SSVC signals: exploitation = none public; automatable = yes; technical impact = total (full access to sensitive healthcare records); mission criticality = high for healthcare deployments. |
| Exploit ScenarioDerived | An unauthenticated attacker sends a crafted HTTP POST request to the KiviCare registration endpoint, including a role field set to 'clinic-staff' or 'doctor'. The plugin creates an active, privileged account without validating the requested role. The attacker then logs in with the newly created credentials and browses patient records and billing data, or modifies appointments and financial entries. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 14, 2026
KiviCare WordPress plugin before version 4.5.2 exposes an unauthenticated registration endpoint that fails to enforce role restrictions, permitting any remote attacker to self-register a privileged clinic-staff (doctor) account without credentials. Once registered, the attacker gains full access to patient records, billing data, and clinic management functions. A vendor patch exists at version 4.5.2; no public exploit has been identified at time of analysis.
RemediationAI
The primary fix is to upgrade KiviCare to version 4.5.2 or later, which enforces server-side role restrictions on the registration endpoint. The patch is confirmed available from the vendor per WPScan advisory (https://wpscan.com/vulnerability/24951a75-46e7-44f9-947b-070ca2f2b244/). If immediate upgrade is not possible, a compensating control is to disable open user self-registration on the KiviCare plugin endpoint at the WordPress or web server layer - for example, via a WAF rule blocking POST requests to the affected registration route, or by temporarily deactivating the plugin until the upgrade can be applied. Disabling registration may impact legitimate onboarding workflows and should be communicated to clinic staff. Audit existing accounts for any unexpected clinic-staff or doctor role assignments that may have been created prior to patching.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
KiviCare is a WordPress plugin providing telemedicine and medical clinic management functionality, including patient records, appointments, and billing. The root cause is CWE-269 (Improper Privilege Management): the plugin's user registration endpoint accepts a caller-supplied role parameter without server-side validation against an allowlist of non-privileged roles. This allows any unauthenticated HTTP client to specify 'clinic-staff' or 'doctor' role during account creation. The flaw is confined to the plugin layer and does not affect WordPress core. All KiviCare versions from 0 up to (but not including) 4.5.2 are affected, per EUVD-2026-57725 and WPScan advisory 24951a75-46e7-44f9-947b-070ca2f2b244.
Know when WordPress gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
AV:N/AC:L/PR:N/UI:N confirmed by endpoint accessibility; I:H added because attacker-controlled doctor account can modify patient and billing records.
Primary rating from Vendor (wpscan).
CVSS VectorVendor: wpscan
Lifecycle Timeline
4DescriptionCVE.org
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Executive ViewAI
The KiviCare WordPress plugin (versions before 4.5.2) permits any unauthenticated attacker to self-register as a privileged doctor account, gaining immediate access to all patient records, billing data, and clinic management systems. This exposure of protected health information creates urgent HIPAA compliance liability and operational risk for healthcare organizations, requiring immediate remediation.
Apply vendor patch: KiviCare WordPress plugin version 4.5.2 or later. Interim mitigation until patched: disable the plugin or isolate from public internet access.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra para
The isMail transport in PHPMailer before 5.2.20 might allow remote attackers to pass extra parameters to the mail comman
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The GiveWP - Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The AI Engine WordPress plugin through version 3.1.3 exposes Bearer Token values through the /mcp/v1/ REST API endpoint
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
Remote code execution in WordPress 6.9.x (before 6.9.5) and 7.0.x (before 7.0.2) arises from a REST API batch endpoint r
Exploit-DB