CVE Catalog
CVE-2026-13612
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk0.14%
4th percentile - higher than 4% of all known CVEs
Summary
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed. Authenticated patient-level users can read other patients' bills, invoices and appointment details.
Risk Assessment
Serious patient privacy breach, including medical and financial data. This can lead to GDPR violations and loss of trust in the healthcare facility.
Recommendation
Update the KiviCare plugin to version 4.5.2 or later. Implement ownership-based access control on records.
Original NVD description (English source)
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.