What the vulnerability does
01Description
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.
Explanation of Vulnerability in Simple Terms
02Summary
KiviCare versions up to 4.1.2 contain an authentication bypass vulnerability. An attacker can gain unauthorized access to the system without valid credentials, potentially reading patient data, modifying medical records, or disrupting clinic operations. No user interaction or special privileges are required to exploit this flaw.
What an attacker can do
03Attacker Capabilities
Bypass authentication and gain unauthorized access to the clinic management system without valid credentials.
Potential impact on your site
04Site Impact
Unauthorized users can access patient records, modify clinic data, and disrupt the EHR system without logging in.
Conditions required to exploit
05Prerequisites
Network access to the KiviCare installation. No authentication, special privileges, or user interaction required.
Key dates
06Disclosure timeline
March 18, 2026
CVE published
April 8, 2026
Record updated
