ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2992

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoin…

Published Mar 18, 2026 · updated Jun 17, 2026

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 18, 2026 · NIST NVD

    Detected

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

  2. Jun 17, 2026 · NIST NVD

    Updated

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

Sources

  • CVE.orgVulnerability recordCVE-2026-2992

    Official CVE identifier

    cve.org
  • NIST NVDVulnerability recordCVE-2026-2992

    The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible

    nvd.nist.gov

References