High severity · published Aug 13, 2026
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 35% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
KiviCare ·
before 4.5.2 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13610
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13610
wpscan.com
https://wpscan.com/vulnerability/24951a75-46e7-44f9-947b-070ca2f2b244/
More from KiviCare
8.8
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
8.8
CVE-2023-2628
KiviCare Management System < 3.2.1 - Multiple CSRF
6.5
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
6.5
CVE-2023-2623
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
6.1
CVE-2023-2624
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting