The vulnerability allows attackers to authenticate as any patient by supplying an email address and a dummy access token. The plugin’s patientSocialLogin() function fails to validate the social provider token before setting authentication cookies. This bypass grants unauthenticated users full access to protected patient data, including medical records, appointments, prescriptions, and billing information, constituting a PII/PHI breach. The flaw also sets authentication cookies for non‑patient users before performing a role check, leading to unnecessary cookie transmission even when the server responds with a 403 status.

Any installation of the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress with a version equal to or older than 4.1.2 is vulnerable.

The CVSS base score of 7.3 indicates a high level of risk, while the EPSS score of less than 1% denotes a low likelihood of exploitation in the wild. The issue is not listed in CISA’s KEV catalog. Based on the description, the attack vector is unauthenticated via web requests, requiring only a user’s email address, which can be supplied in a crafted HTTP request. No special privileges or configuration are needed to exploit the flaw.