The KiviCare WordPress plugin fails to validate that an authenticated patient is modifying their own appointment. Before version 4.5.4, the plugin’s cancellation and rescheduling endpoints accept any appointment identifier without checking ownership, allowing a patient-level user to cancel or reschedule another patient’s appointments. This flaw is an Insecure Direct Object Reference (CWE‑639) that undermines the integrity and availability of the scheduling system but does not provide code execution or data exfiltration.

All installations of the KiviCare WordPress plugin older than 4.5.4 are affected. The vulnerability resides in the core appointment modification endpoints that do not verify appointment ownership before processing cancel or reschedule actions; any WordPress site running the susceptible plugin version is at risk.

The CVSS score of 4.3 indicates moderate severity, while the EPSS score of <1% suggests a very low likelihood of exploitation. The flaw is not listed in the CISA KEV catalog. An attacker must first authenticate as a patient-level user, then craft an HTTP request containing a foreign appointment ID. The likely attack vector is a simple direct web request to the modification endpoint, which can be performed in a straightforward manner once credentials are in place.