CVE-2026-40792

Vulnerability

The KiviCare plugin for WordPress versions 4.2.1 and earlier contains an Insecure Direct Object Reference (IDOR) vulnerability that allows authenticated users with subscriber-level privileges to access unauthorized resources by manipulating object identifiers [1].

Exploitation

An attacker with a subscriber-level account on a WordPress site running the vulnerable plugin can exploit this IDOR by sending HTTP requests with manipulated object identifiers (e.g., patient IDs, appointment IDs) to access data belonging to other users or privileged resources. No additional user interaction is required [1].

Impact

Successful exploitation allows an attacker to view, modify, or delete sensitive data such as patient records, appointments, and other clinic management information. This can lead to significant data breaches and privacy violations [1].

Mitigation

The vulnerability is fixed in version 4.3.0 of the KiviCare plugin. Users are strongly advised to update immediately. For those unable to update, Patchstack offers a mitigation rule that blocks attacks until the update is applied [1].