The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Kivicare Clinic Management System Plugin | — | Update kivicare-clinic-management-system plugin to version 4.1.3, or a newer patched version | Apr 30, 2026 | Mar 17, 2026 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub