The KiviCare – Clinic & Patient Management System plugin allows attackers who are not logged into the WordPress site to upload arbitrary text and PDF files through the uploadMedicalReport() endpoint. Because no authorization check is performed, an attacker can place files on the server that may be served to visitors, potentially hosting malicious code or phishing content. This vulnerability can lead to a compromise of the site’s content integrity and provide a foothold for further attacks such as phishing or credential harvesting.

The vulnerability affects the KiviCare – Clinic & Patient Management System (EHR) plugin from iqonicdesign, versions up to and including 3.6.15. No other versions or products are listed as affected.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% suggests that exploitation attempts are expected to be rare, and the vulnerability is not currently listed in the CISA KEV catalog. The likely attack vector is an unauthenticated HTTP request to the upload endpoint. If exploited, the attacker could host malicious content on the site’s server for use in phishing or further attacks. The vulnerability’s impact remains limited to files uploaded by the attacker, but it can be leveraged for higher-level attacks depending on the attacker’s goals.