CVE-2026-13610 — KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to creat…
Published: 2026-08-13 · CVSS: 7.5 · CVSS 3.1
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7