Unrestricted File Download Vulnerability in KiviCare WordPress Plugin
CVE-2026-19417
Key Information:
Badges
What is CVE-2026-19417?
The KiviCare WordPress plugin, versions prior to 4.5.4, is susceptible to an unrestricted file download vulnerability. This security flaw arises from the plugin's failure to properly verify if an authenticated user has the right to access specific media files. As a result, patient-level users may exploit this vulnerability to access and download any file within the media library, including sensitive medical reports uploaded by other patients. This breach poses significant privacy risks and exposes personal health information, highlighting the necessity for immediate updates and robust security measures.
Affected Version(s)
KiviCare 0 < 4.5.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.