WordPress Plugin Vulnerabilities

KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR

Description

The plugin does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

Proof of Concept

Affects Plugins

Plugin icon
kivicare-clinic-management-system
Fixed in 4.5.4

References

CVE
CVE-2026-19416

Classification

Type
IDOR
OWASP top 10
A5: Broken Access Control
CWE
CWE-639
CVSS
4.3 (medium)

Miscellaneous

Original Researcher
Erwan LR (WPScan)
Submitter
Erwan LR (WPScan)
Verified
Yes
WPVDB ID
ef2aa44b-3624-4e6d-9b25-e33d4a1a21d2

Timeline

Publicly Published
2026-08-17 (about 3 days ago)
Added
2026-08-17 (about 2 days ago)
Last Updated
2026-08-17 (about 2 days ago)

Other

Published
Title
Published
2021-05-16
Title
Listeo < 1.6.11 - Multiple Authenticated IDOR Vulnerabilities
Published
2025-02-21
Title
WP Job Portal < 2.2.9 - Insecure Direct Object Reference to Authenticated (Subscriber+) User Photo Disconnection
Published
2026-07-14
Title
Academy LMS <= 3.8.2 - Subscriber+ Sensitive Information Disclosure via quiz_attempts REST Endpoint
Published
2024-01-16
Title
Display custom fields in the frontend – Post and User Profile Fields < 1.3.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Meta Disclosure
Published
2024-11-22
Title
Enter Addons – Ultimate Template Builder for Elementor < 2.2.0 - Authenticated (Contributor+) Post Disclosure