CVE-2026-19417

Deferred Deferred - Pending Action

Authenticated Users Can Access Unauthorized Medical Files via KiviCare WordPress Plugin

Publication date: 2026-08-19

Last updated on: 2026-08-26

Assigner: WPScan

Description

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-19

Last Modified

2026-08-26

Generated

2026-09-08

AI Q&A

2026-08-19

EPSS Evaluated

2026-09-07

NVD

CVE-2026-19417

EUVD

EUVD-2026-62290

Affected Vendors & Products

Vendor	Product	Version / Range
kivicare	kivicare_wordpress_plugin	to 4.5.4 (exc)
kivicare	kivicare	to 4.5.4 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-639	The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Attack-Flow Graph

Executive Summary

This is an Insecure Direct Object Reference (IDOR) flaw in the KiviCare WordPress plugin before version 4.5.4. It allows authenticated patient-level users to download any file in the media library without proper authorization checks, including other patients' sensitive medical reports.

Detection Guidance

Check if your KiviCare plugin version is below 4.5.4. Log in as a patient-level user and attempt to access media files via direct URLs or API endpoints. Monitor for unauthorized file downloads or access attempts in server logs.

Impact Analysis

Authenticated patient-level users could access and download unauthorized files, including other patients' medical reports. This could lead to privacy breaches, unauthorized data exposure, and potential misuse of sensitive health information.

Compliance Impact

This vulnerability likely violates GDPR and HIPAA due to unauthorized access to protected health information. GDPR requires strict access controls for personal data, while HIPAA mandates safeguards for protected health information. Non-compliance could result in legal penalties and reputational damage.

Mitigation Strategies

Update the KiviCare plugin to version 4.5.4 or later immediately. Review and restrict media library access permissions. Implement additional access controls to verify user authorization before serving files.

Hi! I’m here to help you understand CVE-2026-19417. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70