CVE-2026-13611 — KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure

CVE-2026-13611

KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure PUBLISHED

Description (CNA)

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.

Affected (CNA)

Vendor / product	Versions
Unknown / KiviCare	affected 0 before 4.5.5

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.