CVE-2026-13610: KiviCare WordPress Auth Bypass Flaw

CVE-2026-13610 Overview

CVE-2026-13610 affects the KiviCare WordPress plugin in versions before 4.5.2. The plugin exposes an unauthenticated registration endpoint that fails to restrict which roles a new account can request. Unauthenticated attackers can submit a registration request and receive an active clinic-staff (doctor) account. That account carries full access to patient records, billing information, and clinic operational data. The flaw sits in the plugin's account provisioning logic and requires no prior credentials, no user interaction, and no elevated context. Any site running a vulnerable KiviCare version is exposed the moment the registration endpoint is reachable.

Critical Impact

Remote, unauthenticated attackers can create fully privileged doctor accounts and read or modify protected health information and billing records.

Affected Products

• KiviCare WordPress plugin versions before 4.5.2
• WordPress sites exposing the plugin's public registration endpoint
• Clinic and healthcare deployments using KiviCare for patient management

Discovery Timeline

• 2026-08-13 - CVE-2026-13610 published to NVD
• 2026-08-13 - Last updated in NVD database

Technical Details for CVE-2026-13610

Vulnerability Analysis

The vulnerability is a broken access control flaw in KiviCare's registration workflow. The plugin accepts a role parameter from unauthenticated HTTP requests and passes it to account creation logic without validating it against an allowlist. Attackers can therefore choose the clinic-staff (doctor) role during self-registration. The resulting account is created in an active state and bypasses any administrator approval step. Once logged in, the attacker inherits every capability the doctor role holds in KiviCare, including patient record access, appointment management, and billing operations. Because the account is legitimate from WordPress's perspective, subsequent actions blend into normal application traffic.

Root Cause

The registration endpoint trusts client-supplied role input and does not enforce server-side role assignment. The plugin also lacks a moderation or verification step that would otherwise block privileged roles from being self-assigned by anonymous users. Version 4.5.2 restricts the assignable roles at the endpoint.

Attack Vector

An attacker sends an HTTP request to the unauthenticated KiviCare registration endpoint with parameters that select the doctor role. The plugin creates the account, activates it, and returns credentials or a session. The attacker then authenticates and accesses clinic dashboards, patient charts, and billing modules. See the WPScan Vulnerability Report for the technical writeup.

No verified proof-of-concept code is published in the referenced advisory. The vulnerability mechanism is described in prose because no sanitized exploit sample is available from the source.

Detection Methods for CVE-2026-13610

Indicators of Compromise

• Unexpected WordPress user accounts created with the KiviCare doctor or clinic-staff role, particularly from unknown email domains.
• Registration events in web server access logs targeting KiviCare registration endpoints from single IPs in short bursts.
• New accounts accessing patient record, appointment, or billing endpoints within minutes of creation.

Detection Strategies

• Audit the WordPress wp_users and wp_usermeta tables for accounts assigned KiviCare privileged roles that were not provisioned by an administrator.
• Review web application firewall and access logs for POST requests to KiviCare registration routes containing role parameters.
• Correlate new-account creation timestamps with immediate access to /wp-admin/admin.php?page=kivicare_* administrative pages.

Monitoring Recommendations

• Alert on any WordPress user creation event where the assigned role is a KiviCare clinical role.
• Track outbound data volume from KiviCare endpoints to detect bulk patient record exfiltration.
• Forward WordPress and web server logs to a central SIEM to preserve evidence of unauthorized registrations.

How to Mitigate CVE-2026-13610

Immediate Actions Required

• Upgrade KiviCare to version 4.5.2 or later on all WordPress sites running the plugin.
• Enumerate existing users with KiviCare privileged roles and disable any account that cannot be attributed to a legitimate provisioning workflow.
• Rotate credentials and force password resets for remaining clinical staff accounts as a precaution.
• Review access logs for patient record exports or billing changes made by accounts created before the patch.

Patch Information

Update to KiviCare 4.5.2 or later, which restricts the roles assignable through the registration endpoint. Refer to the WPScan Vulnerability Report for advisory details.

Workarounds

• Disable public registration for the KiviCare plugin until the patch is applied.
• Place the WordPress site behind a web application firewall rule that blocks role parameters in requests to KiviCare registration endpoints.
• Restrict access to the site's registration path by IP allowlist where feasible.
• Require administrator approval for all new user accounts through a moderation plugin.

# Configuration example: block role parameter tampering at the WAF layer
# Example ModSecurity rule (adapt endpoint path to your KiviCare install)
SecRule REQUEST_URI "@contains /wp-json/kivicare/" \
    "chain,phase:2,deny,status:403,id:1026013610,\
     msg:'CVE-2026-13610 KiviCare role parameter blocked'"
    SecRule ARGS_NAMES "@rx ^role$" "t:lowercase"