WordPress Plugin Vulnerabilities

KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR

Description

The plugin does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.

Proof of Concept

Affects Plugins

Plugin icon
kivicare-clinic-management-system
Fixed in 4.5.2

References

CVE
CVE-2026-13612

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Sai Praneeth Koti
Submitter
Sai Praneeth Koti
Verified
Yes
WPVDB ID
0f48c1a3-d1f2-4028-b864-190c7f58becd

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2024-12-02
Title
Charity Addon for Elementor <= 1.3.3 - Authenticated (Contributor+) Post Disclosure
Published
2026-01-02
Title
Sweet Jane <= 1.2 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2026-06-05
Title
Charitable < 1.8.11.2 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Attachment Deletion via 'avatar' Parameter
Published
2024-03-29
Title
Whizzy <= 1.1.18 - Authenticated (Subscriber+) Insecure Direct Object Reference
Published
2025-03-14
Title
School Management System – WPSchoolPress < 2.2.17 - Teacher+ Privilege Escalation