CVE-2026-11990: KiviCare WordPress Auth Bypass Vulnerability

CVE-2026-11990 Overview

CVE-2026-11990 is an authorization bypass vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress. The flaw affects all versions up to and including 4.4.0. The plugin fails to verify whether a requesting user is authorized to perform appointment and payment operations [CWE-862]. Unauthenticated attackers can mark arbitrary pending appointments as Confirmed and forge completed payment records in the wp_kc_payments_appointment_mappings table using an attacker-supplied payment ID. The default gateway resolution logic returns all registered gateways regardless of admin-enabled status, making the manual KCPayLater gateway always selectable on a default installation.

Critical Impact
Unauthenticated attackers can confirm appointments and forge payment records, bypassing the payment workflow entirely on default KiviCare installations.

Affected Products

KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress
All versions up to and including 4.4.0
Default installations exposing the KCPayLater manual payment gateway

Discovery Timeline

2026-07-10 - CVE-2026-11990 published to NVD
2026-07-10 - Last updated in NVD database

Technical Details for CVE-2026-11990

Vulnerability Analysis

The vulnerability stems from missing authorization checks in the KiviCare plugin's appointment and payment API endpoints. The plugin exposes REST endpoints handled by AppointmentsController.php that accept appointment status and payment mapping updates. These endpoints do not validate that the requester is authenticated or owns the appointment being modified. An attacker can submit a crafted request that transitions a pending appointment into the Confirmed state and simultaneously inserts a row into wp_kc_payments_appointment_mappings referencing an arbitrary payment ID supplied by the attacker.

Root Cause

Two compounding defects drive the issue. First, the appointment status and payment mapping handlers in AppointmentsController.php at lines 465 and 3931 omit capability and ownership checks before writing to the database. Second, the KCPaymentGatewayFactory.php gateway resolution logic at line 131 returns all registered gateways regardless of the administrator's enabled status. This ensures the manual-payment KCPayLater gateway remains selectable, allowing the attacker to complete the flow via KCAppointmentPaymentService.php without processing a real transaction. This falls under Missing Authorization [CWE-862].

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker sends a crafted HTTP request to the vulnerable KiviCare appointment API, specifying a target appointment ID, a Confirmed status transition, and an arbitrary payment ID routed through the KCPayLater gateway. The plugin accepts the request, mutates appointment state, and records a fabricated payment mapping. Detailed source-level references are available in the Wordfence Vulnerability Report and in the WordPress Plugin Code Review for AppointmentsController.php.

Detection Methods for CVE-2026-11990

Indicators of Compromise

Rows in wp_kc_payments_appointment_mappings referencing payment IDs that do not correspond to legitimate gateway transactions.
Appointments transitioned to Confirmed status without a matching authenticated user session or admin action in access logs.
Unexpected use of the KCPayLater gateway on installations that do not offer manual pay-later payments to patients.

Detection Strategies

Review web server access logs for unauthenticated requests to KiviCare REST API endpoints handling appointment status updates and payment mappings.
Correlate database writes to wp_kc_payments_appointment_mappings with authenticated session identifiers to surface orphan payment records.
Compare appointment state transitions against WordPress user activity to identify status changes lacking a corresponding logged-in actor.

Monitoring Recommendations

Enable verbose logging on the WordPress REST API and forward events to a centralized log platform for behavioral analysis.
Alert on bulk appointment Confirmed transitions occurring within short time windows from a single source IP.
Monitor for new payment mapping rows containing attacker-controlled or malformed payment identifiers.

How to Mitigate CVE-2026-11990

Immediate Actions Required

Upgrade the KiviCare plugin to a release later than 4.4.0 once the vendor publishes a fixed version.
Audit the wp_kc_payments_appointment_mappings table and remove fraudulent entries created by unauthenticated actors.
Disable the KCPayLater gateway in the plugin settings if manual pay-later functionality is not required.

Patch Information

A vendor changeset is referenced in the WordPress Plugin Changeset. Administrators should apply the plugin update as soon as a version above 4.4.0 is available and validate that authorization checks are enforced on the affected endpoints. Refer to the Wordfence Vulnerability Report for remediation guidance.

Workarounds

Restrict access to the WordPress REST API for KiviCare endpoints using a web application firewall rule until patched.
Deactivate the KiviCare plugin on internet-facing clinic sites if a patch is not yet available.
Enforce authentication requirements on /wp-json/kc/* routes via server-side access controls or reverse proxy rules.

bash

# Example nginx rule blocking unauthenticated access to KiviCare REST endpoints
location ~ ^/wp-json/kc/ {
    if ($http_cookie !~* "wordpress_logged_in") {
        return 403;
    }
}