Authentication Bypass in KiviCare Plugin for WordPress
CVE-2026-19416
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-19416?
The KiviCare WordPress plugin, prior to version 4.5.4, lacks sufficient checks to ensure that users are authorized to modify appointments. This flaw allows authenticated patients to manipulate other patients' appointments by canceling or rescheduling them without proper permissions. As a result, the vulnerability poses significant privacy and integrity risks to patient data and appointment management within the application.
Affected Version(s)
KiviCare 0 < 4.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.