CVE-2026-13610

Name of the Vulnerable Software and Affected Versions KiviCare versions prior to 4.5.2

Description The KiviCare WordPress plugin contains a flaw in its unauthenticated registration endpoint that fails to restrict the roles that can be assigned during account creation. This allows an unauthenticated attacker to create a privileged clinic-staff (doctor) account, granting them full access to billing, clinic data, and patient records.

Recommendations Update KiviCare to version 4.5.2 or later.