Vulnerability · Published Aug 13, 2026 · Assigned by WPScan
CVE-2026-13610KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
High 7.5
In plain English
A high-severity privilege mismanagement in KiviCare from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.4%top 64.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.
Affected products (as reported)
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://wpscan.com/vulnerability/24951a75-46e7-44f9-947b-070ca2f2b244/ exploit, vdb-entry, technical-description