CVE-2026-19417
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk4th percentile - higher than 4% of all known CVEs
Summary
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
Risk Assessment
Disclosure of sensitive medical data of other patients can violate data protection regulations (e.g., GDPR) and harm the organization's reputation.
Recommendation
Update the KiviCare plugin to version 4.5.4 or later. Immediately check file access logs for unauthorized downloads.
Original NVD description (English source)
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.