CVE-2026-0927: KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-0927?
CVE-2026-0927 is rated as a high severity vulnerability due to its potential for arbitrary file uploads without proper authorization.
How do I fix CVE-2026-0927?
To fix CVE-2026-0927, you should update the KiviCare – Clinic & Patient Management System plugin to version 3.6.16 or later.
What systems are affected by CVE-2026-0927?
CVE-2026-0927 affects versions of KiviCare – Clinic & Patient Management System for WordPress up to and including version 3.6.15.
What is the nature of the vulnerability in CVE-2026-0927?
CVE-2026-0927 involves missing authorization checks that allow unauthenticated users to upload arbitrary files.
Who is responsible for addressing CVE-2026-0927?
The developers of the KiviCare plugin are responsible for addressing CVE-2026-0927 by providing security updates and fixes.