The KiviCare WordPress plugin allows unauthenticated users to call certain REST endpoints without performing authorization checks, enabling them to retrieve the full list of patients and, if a payment gateway is configured, the secret key associated with that gateway. These actions provide the attacker with sensitive personal health information and possibly financial credentials, which could be used for further fraud or identity theft. The vulnerability resides in missing access control and insufficient input validation for API routes, classifying it under CWE-200.

Affected systems include any WordPress site using the KiviCare Clinic & Patient Management System plugin with a version earlier than 4.5.5. No vendor name is officially supplied; the plugin is referenced under a generic 'Unknown:KiviCare' identifier. Administrators should verify the plugin version and confirm whether a payment gateway integration is active, as that determines the full scope of exposed data.

The CVSS score of 5.3 indicates moderate risk, and the EPSS score of less than 1% suggests a very low probability of exploitation in the wild. The vulnerability is not currently listed in the CISA KEV catalog. Because the exploit requires only unauthenticated HTTP requests to specific REST endpoints, an attacker can launch this attack from anywhere with network access to the WordPress instance. Without mitigation, the attacker could read confidential patient records and potentially intercept or misuse payment information, compromising confidentiality and possibly leading to financial loss.