CVE-2026-13612: KiviCare < 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR
Published Aug 12, 2026
·Updated
The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.
Affected Software
1 affected component
WordPress plugin KiviCare<4.5.2
Event History
Aug 12, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·06:17 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2026-13612?
CVE-2026-13612 has a risk score of 52, indicating a moderate level of severity.
2
How do I fix CVE-2026-13612?
To fix CVE-2026-13612, update the KiviCare WordPress plugin to version 4.5.2 or later.
3
What systems are affected by CVE-2026-13612?
CVE-2026-13612 affects KiviCare WordPress plugin versions prior to 4.5.2.
4
What type of vulnerability is CVE-2026-13612?
CVE-2026-13612 is an IDOR (Insecure Direct Object Reference) vulnerability that allows unauthorized access to patient records.
5
Who is affected by CVE-2026-13612?
Authenticated patient-level users are affected by CVE-2026-13612 as they can access other patients' bills, invoices, and appointment details.