CVE-2026-19417 — KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

CVE-2026-19417

KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR PUBLISHED

Description (CNA)

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

Affected (CNA)

Vendor / product	Versions
Unknown / KiviCare	affected 0 before 4.5.4

CWE

No CWE identifiers supplied.

References

https://wpscan.com/vulnerability/4270b160-cbb8-46b2-853c-927651ca16bf/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.