The KiviCare – Clinic & Patient Management System plugin for WordPress contains a flaw that allows an unauthenticated actor to change the status of any pending appointment to Confirmed and to create a payment record that links the appointment with a payment ID supplied by the attacker. This bypasses the normal payment process and enables the attacker to obtain services or claim revenue without any real payment. The vulnerability stems from an absence of authorization checks on the appointment update logic, allowing the system to trust data supplied by an unauthenticated source.

All publicly available releases of the KiviCare plugin from iqonicdesign that are version 4.4.0 or earlier are affected. The flaw is present in the core classes that handle payment gateway resolution and the controller that updates appointment status and writes payment mappings.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploit attempts are infrequent. The vulnerability is not listed in CISA’s KEV catalog. Attackers would need only network access to the target WordPress site and the ability to issue an unauthenticated HTTP request to the endpoint that updates appointment status, supplying an appointment identifier and a forged payment ID. Based on the description, it is inferred that the exploit would involve sending such a request, though the exact endpoint name is not provided in the release notes.