CVE Feed

    Dashboard / CVE / CVE-2026-11990

    CVE-2026-11990

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending appointments as Confirmed and forge an associated completed payment record in wp_kc_payments_appointment_mappings using an attacker-supplied payment ID, bypassing payment entirely. This exploit is achievable on a default installation because the gateway resolution logic returns all registered gateways regardless of admin-enabled status, making the manual (KCPayLater) gateway always selectable.

    Published:Jul 10, 2026
    Last Modified:Jul 10, 2026
    EPS:Jul 10, 2026
    EPSS Score:0.00561
    CVSS Score:5.3

    Affected Products

    Vendor
    Iqonicdesign
    Product
    Kivicare – Clinic & Patient Management System (ehr)
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-862 Missing Authorization

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-665 Exploitation of Thunderbolt Protection Flaws

    Related CVEs

    CVE-2026-15453 (CVSS 6.5) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Inje…
    CVE-2026-15072 (CVSS 6.5) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Inje…
    CVE-2026-15073 (CVSS 6.5) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Inje…
    CVE-2026-2992 (CVSS 8.2) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escala…
    CVE-2026-2991 (CVSS 7.3) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication B…
    CVE-2026-0927 (CVSS 5.3) — The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file u…

    References

    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/baseClasses/KCPaymentGatewayFactory.php#L131
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/controllers/api/AppointmentsController.php#L3931
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/controllers/api/AppointmentsController.php#L465
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/paymentGateways/KCPayLater.php#L109
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/services/KCAppointmentPaymentService.php#L32
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/baseClasses/KCPaymentGatewayFactory.php#L131
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/controllers/api/AppointmentsController.php#L3931
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/controllers/api/AppointmentsController.php#L465
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/paymentGateways/KCPayLater.php#L109
    https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/services/KCAppointmentPaymentService.php#L32
    https://plugins.trac.wordpress.org/changeset?reponame=&old=3599918%40kivicare-clinic-management-system&new=3599918%40kivicare-clinic-management-system
    https://www.wordfence.com/threat-intel/vulnerabilities/id/efe4223a-5c1a-401e-a46b-0278e96d2d71?source=cve

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High