CVE-2026-42735

Vulnerability

The KiviCare plugin for WordPress, versions from n/a through and including 4.3.0, contains an authentication bypass vulnerability using an alternate path or channel. This flaw specifically relates to password recovery exploitation, where the plugin fails to properly validate authentication mechanisms during the password reset flow [1]. This allows a malicious actor to execute actions that should normally be restricted to higher-privileged users.

Exploitation

An unauthenticated attacker can exploit this vulnerability without requiring any prior credentials or user interaction. By manipulating the password recovery workflow through an alternate path, the attacker can bypass normal authentication checks and trigger a password reset for a privileged account [1]. The attack does not require any special network position beyond standard web access to the WordPress site.

Impact

Successful exploitation allows the attacker to take over a user account, potentially gaining administrative access to the WordPress site. This leads to complete compromise of the affected website, including the ability to modify content, install malicious plugins, and access sensitive data [1]. The vulnerability has a CVSS v3 score of 8.2 (High), indicating significant potential for harm.

Mitigation

The official fix was released in version 4.4.0 of the KiviCare plugin on or before 2026-05-27 [1]. Users must update to version 4.4.0 or later immediately to resolve the vulnerability. For Patchstack users, a mitigation rule is available to block attacks until the update is applied [1]. The vulnerability is expected to be exploited in mass campaigns as per the advisory.