The vulnerability is an Insecure Direct Object Reference (IDOR) affecting the KiviCare plugin for WordPress. It allows an authenticated subscriber or any user with the correct API endpoint structure to access or modify other subscribers’ data simply by manipulating object identifiers. The weakness enables a user to read or alter confidential patient or appointment information, violating confidentiality and integrity.

The issue affects the Iqonic Design KiviCare plugin for WordPress, versions up to and including 4.2.1. Any WordPress site that has a vulnerable KiviCare installation is potentially impacted.

The CVSS score of 6.3 indicates a moderate severity risk, and the EPSS score of less than 1% suggests that successful exploitation is currently unlikely but still possible. The vulnerability is not listed in the CISA KEV catalog. An attacker can exploit the IDOR by crafting requests to resource URLs or API endpoints that reference subscriber IDs, bypassing normal access controls. No additional prerequisites are specified beyond having valid HTTP access to the site; however, it likely requires the attacker to be authenticated as a regular subscriber to make the request. The lack of an exploitation patch and low exploit probability mean the risk is moderate but should be mitigated promptly.