CVE-2026-0927

MEDIUM 5.3

KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload

CVSS Score

5.3

EPSS Score

0.0%

EPSS Percentile

0th

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.

CWE	CWE-862
Vendor	iqonicdesign
Product	kivicare – clinic & patient management system (ehr)
Published	Jan 23, 2026
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for iqonicdesign kivicare – clinic & patient management system (ehr)

Be the first to know when new medium vulnerabilities affecting iqonicdesign kivicare – clinic & patient management system (ehr) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

iqonicdesign / KiviCare – Clinic & Patient Management System (EHR)

0 ≤ 3.6.15

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/489931ef-bac3-4de8-84ec-6f226d96f778?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php#L1328 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/3.6.15/app/controllers/KCAppointmentController.php#L1328 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3443088/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php

Credits

Sarawut Poolkhet