Executive brief
KiviCare is a WordPress clinic management plugin that allows patients to view their medical records, bills, and appointments. A flaw in the plugin fails to verify that a logged-in patient owns the records they are requesting, allowing any patient to read other patients' sensitive health and financial information including bills, invoices, and appointment details.
Technical details
The vulnerability is an Insecure Direct Object Reference (IDOR) in the KiviCare REST API endpoints for bills, appointments, and invoices. The affected endpoints (wp-json/kivicare/v1/bills/{id}, wp-json/kivicare/v1/appointments/{id}/view, and wp-json/kivicare/v1/appointments/{id}/print-invoice) perform role-level capability checks only (patient_bill_view, appointment_view, read) without verifying that the requesting user owns the specific record. Any authenticated patient-level user can substitute arbitrary record IDs to access other patients' protected health information. KiviCare allows patient self-registration, making this vulnerability accessible to any user who creates an account. The issue was fixed in version 4.5.2, with the three affected routes now returning HTTP 403 when a patient attempts to access records they do not own.
Affected products
- KiviCare KiviCare before 4.5.2
Timeline
- 2026-08-10: disclosed
- 2026-08-12: patched: version 4.5.2 released