Data Exposure in KiviCare WordPress Plugin Affecting Patient Privacy
CVE-2026-13612
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-13612?
The KiviCare WordPress plugin prior to version 4.5.2 fails to ensure that users can only access their own records, inadvertently allowing authenticated users to read sensitive information such as bills, invoices, and appointment details of other patients. This lack of adequate access verification poses a serious risk to patient confidentiality and data integrity.
Affected Version(s)
KiviCare 0 < 4.5.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.