CVE-2026-19416

Name of the Vulnerable Software and Affected Versions KiviCare versions prior to 4.5.4

Description The KiviCare WordPress plugin fails to verify if the requesting user is the owner of the appointment being modified. This allows authenticated users with patient-level privileges to cancel or reschedule appointments belonging to other patients through an Insecure Direct Object Reference (IDOR), which occurs when an application provides direct access to objects based on user-supplied input without sufficient authorization checks.

Recommendations Update KiviCare to version 4.5.4 or later.