5.3
Moyenne
CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing…
Description
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| KiviCare 4.5 | premières → < 4.5.5 | 4.5.5 |
Autres CVE de KiviCare
Les 10 CVE de KiviCare →
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being…
6.5
Moyenne
CVE-2026-19416
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being…
4.3
Moyenne
CVE-2026-13610
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated…
7.5
Élevée
CVE-2026-13613
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before…
8.8
Élevée