The WordPress KiviCare clinic management plugin contains a missing authorization flaw that permits unauthorized users to trigger actions normally reserved for privileged accounts. This weakness, classified as CWE‑862, can enable attackers to access or modify sensitive patient records, schedule appointments, or perform administrative functions without proper authentication. As a result, confidential data may be disclosed, integrity of medical data may be compromised, and overall service availability could be disrupted if malicious changes are made.

Organizations running the Iqonic Design KiviCare WordPress plugin with any release up to version 3.6.16 are impacted. The vulnerability applies to all WordPress installations that have the plugin installed and configured, regardless of the site's user roles or server environment.

With a CVSS base score of 6.5, the flaw presents moderate severity. The EPSS score is below 1%, indicating a low likelihood of current exploitation, and the vulnerability is not listed in CISA's KEV catalog. The likely attack vector is web-based; an attacker only needs network access to the site, potentially even without authenticated credentials, to reach the vulnerable plugin endpoints and abuse the broken access controls. Effective exploitation would grant unauthorized access to administrative functionality.