CVE-2026-13612 Overview
CVE-2026-13612 affects the KiviCare WordPress plugin in versions before 4.5.2. The plugin fails to verify that a requesting user owns the medical records being accessed. Authenticated users with patient-level privileges can read other patients' bills, invoices, and appointment details.
The issue is classified as an Insecure Direct Object Reference (IDOR), a form of broken access control [CWE-639]. Because KiviCare handles medical practice management data, exploitation exposes personally identifiable information (PII) and protected health information (PHI) across tenants of the same installation.
Critical Impact
Any authenticated patient can enumerate and read billing records, invoices, and appointments belonging to other patients on the same KiviCare site.
Affected Products
- KiviCare WordPress plugin versions prior to 4.5.2
- WordPress sites using KiviCare for clinic and patient management
- Multi-tenant medical practices running the vulnerable plugin release
Discovery Timeline
- 2026-08-12 - CVE-2026-13612 published to NVD
- 2026-08-12 - Last updated in NVD database
Technical Details for CVE-2026-13612
Vulnerability Analysis
KiviCare exposes patient-facing endpoints that return billing, invoice, and appointment records identified by numeric object IDs. The plugin authenticates the requesting session but does not perform an ownership check against the target record before returning data.
An authenticated patient can substitute another patient's record identifier into a legitimate request. The server returns the requested object without verifying that the identifier belongs to the caller. This pattern is a textbook Insecure Direct Object Reference.
The scope covers financial records (bills, invoices) and scheduling data (appointment details). Both categories contain regulated health and payment information subject to HIPAA, GDPR, and PCI considerations depending on jurisdiction.
Root Cause
The root cause is a missing authorization check in the record retrieval logic. The plugin conflates authentication with authorization. A valid session cookie is treated as sufficient proof to return any requested record, rather than restricting access to records owned by the authenticated user.
Attack Vector
Exploitation requires a valid patient-level account on the target site. The attacker submits requests to the KiviCare patient endpoints and iterates through record identifiers. See the WPScan Vulnerability Advisory for advisory-level detail. No verified proof-of-concept code is published, so no synthetic exploit is included here.
Detection Methods for CVE-2026-13612
Indicators of Compromise
- Authenticated patient sessions issuing sequential or high-volume requests to KiviCare bill, invoice, or appointment endpoints
- HTTP 200 responses returning record IDs that do not match the requesting user's patient ID
- A single account accessing records tied to multiple distinct patient identifiers within a short window
Detection Strategies
- Instrument KiviCare AJAX and REST endpoints to log the authenticated user ID alongside the requested record ID for correlation
- Alert when the requester's patient ID does not match the owner ID of the returned record
- Baseline normal per-account request volume against KiviCare endpoints and flag deviations
Monitoring Recommendations
- Forward WordPress access logs and PHP application logs to a centralized SIEM for cross-account correlation
- Retain KiviCare request telemetry for the duration required by applicable healthcare data regulations
- Review web application firewall (WAF) telemetry for enumeration patterns targeting kivicare route prefixes
How to Mitigate CVE-2026-13612
Immediate Actions Required
- Update the KiviCare plugin to version 4.5.2 or later on all affected WordPress installations
- Audit application logs for prior access to bills, invoices, and appointments by non-owning patient accounts
- Notify affected patients and regulators if unauthorized record access is confirmed
Patch Information
The vendor addressed the issue in KiviCare 4.5.2 by adding ownership verification before returning patient records. Administrators should apply the update through the WordPress plugin manager or by deploying the updated plugin package. Refer to the WPScan Vulnerability Advisory for advisory metadata.
Workarounds
- Restrict patient portal access to trusted users only until the patch is deployed
- Deploy a WAF rule that blocks patient-scope requests where the record identifier does not match the authenticated session's patient ID
- Temporarily disable the KiviCare plugin if patient self-service access is not operationally required
# Update KiviCare via WP-CLI
wp plugin update kivicare-clinic-management-system --version=4.5.2
wp plugin list --name=kivicare-clinic-management-system --fields=name,version,status
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
