The vulnerability arises from a missing authorization check on the REST API endpoint '/wp-json/kivicare/v1/setup-wizard/clinic', allowing any unauthenticated user to POST data that creates a new clinic and simultaneously creates a WordPress user with clinic admin privileges. This grants the attacker full administrative access to the WordPress installation and to the KiviCare system, including sensitive patient data. The weakness corresponds to CWE-862: Missing Authorization.

The vulnerability affects the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, developed by iqonicdesign, in all plugin versions up to and including 4.1.2. Users running any of these versions are susceptible to the unauthenticated privilege escalation described above.

The CVSS score is 8.2, classifying the issue as high severity. While an EPSS score is not provided, the vulnerability exists in software widely used in healthcare settings, so the risk of exploitation is non-negligible. The lack of a KEV listing indicates there is no publicly known exploit code yet, but the attack vector relies on sending an unauthenticated HTTP POST request to the vulnerable REST endpoint, which is trivially reachable by anyone with internet access to the site. Therefore, the vulnerability can be exploited with minimal effort.