CVE-2026-13610 — KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration

CVE-2026-13610

KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration PUBLISHED

Description (CNA)

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.

Affected (CNA)

Vendor / product	Versions
Unknown / KiviCare	affected 0 before 4.5.2

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/24951a75-46e7-44f9-947b-070ca2f2b244/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.