medium5.3
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose …
Impact
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Affected products
| Product | Affected versions |
|---|---|
| KiviCare WordPress Plugin | before 4.5.5 |
Versions were read from the advisory text. No structured product data has been published for this record yet.