What the vulnerability does
01Description
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.
Explanation of Vulnerability in Simple Terms
02Summary
KiviCare versions up to 3.6.15 lack proper authorization checks, allowing unauthenticated attackers to modify data through network requests. The vulnerability does not expose sensitive information or disrupt service availability, but permits unauthorized changes to system records. Site administrators should update to a version newer than 3.6.15 immediately.
What an attacker can do
03Attacker Capabilities
Modify data in the system without authentication or permission.
Potential impact on your site
04Site Impact
Patient records, clinic settings, or other managed data can be altered by anyone with network access.
Conditions required to exploit
05Prerequisites
Network access only; no authentication or user interaction required.
Key dates
06Disclosure timeline
January 23, 2026
CVE published
April 8, 2026
Record updated
