CVE-2026-19417: KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR

Q: Which accounts can exploit this issue?

Authenticated users with patient-level access can exploit it. No higher-privileged account is stated as necessary.

Q: What data may be exposed?

An affected patient-level user may be able to download any file in the WordPress media library, including medical reports uploaded by other patients.

Published Aug 19, 2026

Updated

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

Affected Software

1 affected component

WordPress plugin: KiviCare<4.5.4

Event History

Aug 19, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Frequently Asked Questions

Which accounts can exploit this issue?

Authenticated users with patient-level access can exploit it. No higher-privileged account is stated as necessary.

What data may be exposed?

An affected patient-level user may be able to download any file in the WordPress media library, including medical reports uploaded by other patients.