The KiviCare WordPress plugin before version 4.5.4 lacks proper access control checks for media file requests. An authenticated patient-level user can trigger a download of any media attachment by guessing or enumerating the attachment ID, allowing unauthorized disclosure of other patients' medical reports. The flaw, identified as an Insecure Direct Object Reference (CWE‑639), results in a confidentiality breach that could expose sensitive personal health information.

Affected software is the KiviCare WordPress plugin with versions earlier than 4.5.4. Users running the plugin in any WordPress installation are potentially vulnerable, regardless of other security controls.

The CVSS score of 6.5 indicates a moderate severity vulnerability. The EPSS score of less than 1% shows that exploitation is unlikely to be widespread. Although the flaw is not tracked in the CISA KEV catalog, it is inferred that an attacker must be a legitimate patient user with access to the site’s authentication system and that the user can supply an attachment ID to download a file. The likely attack vector involves an authenticated patient requesting arbitrary media attachments, and based on the description, it is inferred that the lack of authorization checks permits this once the user initiates a request. The level of technical expertise required for exploitation is inferred to be low.