4.3
Medium
CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being…
Description
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| KiviCare 4.5 | earliest → < 4.5.4 | 4.5.4 |
References
- wpscan.com wpscan.com
Timeline
- Published
- Last modified
Other CVEs of KiviCare
The 10 CVEs of KiviCare →
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing…
5.3
Medium
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being…
6.5
Medium
CVE-2026-13610
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated…
7.5
High
CVE-2026-13613
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before…
8.8
High