# CVE-2026-13612: KiviCare insufficient access control in patient records

Source: https://junglewise.ai/threats/cve-2026-13612-kivicare-insufficient-access-control-in-patient-records  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-08-12. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-13612 · Severity: medium · CVSS 4.3 · Published 2026-08-12

KiviCare is a WordPress clinic management plugin that allows patients to view their medical records, bills, and appointments. A flaw in the plugin fails to verify that a logged-in patient owns the records they are requesting, allowing any patient to read other patients' sensitive health and financial information including bills, invoices, and appointment details.

## Quick answers

**Is CVE-2026-13612 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-13612 being exploited in the wild.

**How severe is CVE-2026-13612?** Medium severity, with a CVSS score of 4.3, published 12 August 2026.

**Which products and versions are affected?** KiviCare KiviCare before 4.5.2.

**Is there a fix for CVE-2026-13612?** A patch was published on 2026-08-12: version 4.5.2 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**Am I affected by CVE-2026-13612?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is an Insecure Direct Object Reference (IDOR) in the KiviCare REST API endpoints for bills, appointments, and invoices. The affected endpoints (wp-json/kivicare/v1/bills/{id}, wp-json/kivicare/v1/appointments/{id}/view, and wp-json/kivicare/v1/appointments/{id}/print-invoice) perform role-level capability checks only (patient_bill_view, appointment_view, read) without verifying that the requesting user owns the specific record. Any authenticated patient-level user can substitute arbitrary record IDs to access other patients' protected health information. KiviCare allows patient self-registration, making this vulnerability accessible to any user who creates an account. The issue was fixed in version 4.5.2, with the three affected routes now returning HTTP 403 when a patient attempts to access records they do not own.

## Affected products

- KiviCare KiviCare before 4.5.2

## Timeline

- 2026-08-10: disclosed
- 2026-08-12: patched: version 4.5.2 released

## References

- [https://wpscan.com/vulnerability/0f48c1a3-d1f2-4028-b864-190c7f58becd/](https://wpscan.com/vulnerability/0f48c1a3-d1f2-4028-b864-190c7f58becd/)