CVE-2026-11990

Name of the Vulnerable Software and Affected Versions KiviCare – Clinic & Patient Management System (EHR) versions prior to 4.4.1

Description An authorization bypass exists because the plugin fails to properly verify if a user is authorized to perform specific actions. Unauthenticated attackers can exploit this to mark pending appointments as Confirmed and forge completed payment records in the wp kc payments appointment mappings table using a supplied payment ID, effectively bypassing the payment process. This is possible on default installations because the gateway resolution logic returns all registered gateways regardless of their admin-enabled status, ensuring the manual (KCPayLater) gateway is always selectable via the /payment-success REST endpoint.

Recommendations Update the plugin to a version newer than 4.4.0. Restrict access to the /payment-success REST endpoint to minimize the risk of exploitation.