KiviCare, a WordPress plugin that manages patient records, contains an insecure direct object reference that allows any authenticated patient-level user to access details belonging to other patients. The flaw stems from the plugin failing to verify ownership of the records being requested, meaning a user can read bills, invoices, and appointment information that should be confidential. Because this is purely an information disclosure issue, an attacker gains only read access and no control over the system, but the breach could cause significant privacy violations and undermine trust in the healthcare platform.

All installations of the KiviCare WordPress plugin prior to version 4.5.2 are affected. The vulnerability applies to the core plugin itself; no additional modules or external products are mentioned in the advisory.

The vulnerability can be exploited by any user who is already authenticated with patient-level permissions, and it requires no special conditions beyond having access to the plugin’s endpoints. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, which indicates that there are no known exploits in the wild yet. However, because the flaw is trivial to detect and leverage once a user is logged in, the risk is moderate to high for sites that store sensitive health‑related data. The CVSS score is not disclosed, so users should treat this as a potentially high‑impact vulnerability that can be mitigated by an official patch.