CVE Catalog
CVE-2026-19416
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Risk Assessment
The ability to manipulate other patients' appointments can disrupt clinic operations and undermine patient trust.
Recommendation
Update the KiviCare plugin to version 4.5.4 or later. Review appointment change logs for unauthorized actions.
Original NVD description (English source)
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.