CVE-2026-13610
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The KiviCare WordPress plugin before version 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Risk Assessment
An attacker can gain full access to sensitive medical and financial data, constituting a serious privacy breach and potentially leading to fraud or regulatory non-compliance.
Recommendation
Update the KiviCare plugin to version 4.5.2 or later, which includes the fix. Restrict registration to trusted users and monitor new accounts.
Original NVD description (English source)
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.