CVE-2026-19417 — KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to do…
Published: 2026-08-19 · CVSS: 6.5 · CVSS 3.1
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7