CVE-2026-19416: KiviCare < 4.5.4 - Patient+ Cross-Patient Appointment Modification via IDOR
Published Aug 19, 2026
·Updated
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Affected Software
1 affected component
KiviCare WordPress plugin<4.5.4
Event History
Aug 19, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Frequently Asked Questions
1
Who can exploit this issue?
An authenticated user with patient-level access can exploit it. The issue allows that user to cancel or reschedule appointments belonging to other patients.
2
Which deployments are affected?
KiviCare WordPress plugin versions before 4.5.4 are affected. The provided information does not identify any configuration prerequisite beyond authenticated patient-level access.
3
What should be done to remediate the issue?
Update the KiviCare WordPress plugin to version 4.5.4 or later. The vulnerability is present in versions before 4.5.4.