CVE-2026-13612

Deferred Deferred - Pending Action

KiviCare Plugin Unauthorized Patient Data Access

Publication date: 2026-08-12

Last updated on: 2026-08-26

Assigner: WPScan

Description

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-12

Last Modified

2026-08-26

Generated

2026-09-01

AI Q&A

2026-08-12

EPSS Evaluated

2026-08-31

NVD

CVE-2026-13612

EUVD

EUVD-2026-57076

Affected Vendors & Products

Vendor	Product	Version / Range
kivicare	kivicare	to 4.5.2 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This vulnerability is an Insecure Direct Object Reference (IDOR) flaw in the KiviCare WordPress plugin before version 4.5.2. It allows authenticated patient-level users to access other patients' bills, invoices, and appointment details without proper authorization because the plugin fails to verify if the requesting user owns the records.

Detection Guidance

To detect this vulnerability, check if your KiviCare plugin version is below 4.5.2. Log in as a patient-level user and attempt to access other patients' bills, invoices, or appointment details by manipulating record IDs in URLs or API requests. If unauthorized data is accessible, the vulnerability exists.

Impact Analysis

If you are a patient using this plugin, your personal billing, invoices, and appointment details could be accessed by other patients. This could lead to privacy breaches, unauthorized disclosure of sensitive information, and potential misuse of your data.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA requirements for protecting patient data. It could result in unauthorized access to protected health information, leading to legal penalties, fines, and reputational damage for organizations using the affected plugin.

Mitigation Strategies

Immediately update the KiviCare plugin to version 4.5.2 or later. If updating is not possible, restrict patient-level user access to sensitive data or disable the plugin until patched. Monitor network traffic for unusual access patterns to patient records.

Hi! I’m here to help you understand CVE-2026-13612. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70