CVE-2026-13611— KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
Quick assessment
Affected
Unknown KiviCare
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
KiviCare WordPress 插件在 4.5.5 版本之前，其部分 REST 接口未执行授权检查，使得未认证的恶意攻击者能够泄露患者名单，并且在配置了支付网关的情况下，还能泄露支付网关的密钥。
Possible ATT&CK Techniques 1 AI
T1040 · Network Sniffing
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-13611
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
Source: CVE Program / CVE List V5
Vulnerability Description
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-13611
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-13611
请登录查看更多情报信息。
Proof of Concept for CVE-2026-13611 (1)
-
🔗 KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 – Unauthenticated Patient Data Disclosure | CVE 2026-13611 | Plugin Vulnerabilities exploit vdb-entry technical-description
Same Patch Batch · Unknown · 2026-09-01 · 3 CVEs total
| CVE-2026-74916 | 6.5 MEDIUM | WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poisoning via Unkeyed Tracking Pa |
| CVE-2026-78363 | 4.8 MEDIUM | MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Execution via Completion Message |
IV. Related Vulnerabilities
Same product: KiviCare
-
CVE-2026-19416
KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modifi -
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read -
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via -
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via se -
CVE-2026-13612
KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and
Same vendor: Unknown
-
CVE-2026-78363
MW WP Form < 5.1.5 - Unauthenticated Arbitrary Shortcode Exe -
CVE-2026-74916
WP Fastest Cache 0.8.7.7 - 1.5.0 - Unauthenticated Cache Poi -
CVE-2026-77013
Icollect <= 1.0.0 - Unauthenticated User and Term Creation v -
CVE-2026-81660
Groundhogg < 4.5.13 - Unauthenticated Stored XSS via Web For -
CVE-2026-81766
Really Simple Security < 9.8.0 - Multisite Subsite Admin+ Ar
V. Comments for CVE-2026-13611
No comments yet