The KiviCare clinic management plugin for WordPress contains an authentication bypass flaw that allows exploitation of the password recovery functionality, enabling attackers to gain authorized access without knowing the correct credentials. This weakness qualifies as an Authentication Failure (CWE‑288) and can result in full control of the web application, exposure of sensitive data, and the potential for further lateral movement within the hosting environment.

WordPress sites running the Iqonic Design KiviCare plugin version 4.3.0 or earlier are affected. The vendor notes the issue exists from an unspecified base release through all versions up to and including 4.3.0; no specific earlier releases are identified, so any site using a pre‑4.3.0 instance should be considered vulnerable.

The CVSS score of 8.2 describes this vulnerability as high severity. The EPSS score is not available, so the current exploitation probability cannot be quantified. The plugin is not listed in the CISA KEV catalog at this time. Attackers can likely exploit the flaw via the web interface of the affected WordPress installation, targeting the password recovery channel to bypass authentication.