Executive brief
KiviCare is a WordPress plugin that manages patient records and clinic operations for healthcare providers. An unauthenticated attacker can access REST endpoints without proper authorization, exposing the complete patient roster (names and IDs) and payment gateway credentials if configured. This exposes sensitive patient data and enables attackers to compromise payment processing.
Technical details
The KiviCare plugin before version 4.5.5 fails to perform authorization checks on specific REST endpoints, including /wp-json/kivicare/v1/static-data. An unauthenticated attacker can exploit this by crafting HTTP requests with an arbitrary X-KC-Client-Id header value to bypass transport encryption filters and retrieve sensitive data. The vulnerability allows disclosure of the full patient roster (user IDs and display names) and, when a payment gateway is configured, extraction of the payment gateway secret key. No authentication, credentials, or prior account access is required. The issue is fixed in KiviCare version 4.5.5.
Affected products
- KiviCare KiviCare before 4.5.5
Timeline
- 2026-08-28: disclosed
- 2026-09-01: patched: Fixed in version 4.5.5