Medium severity · published Sep 1, 2026
CVE-2026-13611
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
5.3
CVSS
0.3%
EPSS
No
On KEV
Description
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 25% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
KiviCare ·
before 4.5.5 · source: vendor
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-13611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-13611
wpscan.com
https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/
More from KiviCare
8.8
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
8.8
CVE-2023-2628
KiviCare Management System < 3.2.1 - Multiple CSRF
7.5
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
6.5
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
6.5
CVE-2023-2623
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure