CVE-2026-13611

MEDIUM CVSS 5.3 View on NVD ↗

Description

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References

https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/

Published: Sep 01, 2026 08:17 UTC Modified: Sep 01, 2026 20:50 UTC