CVE-2026-2992

HIGH 8.2

KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard

CVSS Score

8.2

EPSS Score

0.0%

EPSS Percentile

0th

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

CWE	CWE-862
Vendor	iqonicdesign
Product	kivicare – clinic & patient management system (ehr)
Published	Mar 18, 2026
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for iqonicdesign kivicare – clinic & patient management system (ehr)

Be the first to know when new high vulnerabilities affecting iqonicdesign kivicare – clinic & patient management system (ehr) are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

iqonicdesign / KiviCare – Clinic & Patient Management System (EHR)

0 ≤ 4.1.2

References

NVD ↗ CVE.org ↗ EPSS Data ↗

wordfence.com: https://www.wordfence.com/threat-intel/vulnerabilities/id/d96743ea-08b1-4b4c-9d62-558b97a6e297?source=cve plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/api/SetupWizardController.php#L31 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/api/SetupWizardController.php#L162 plugins.trac.wordpress.org: https://plugins.trac.wordpress.org/changeset/3467409/

Credits

Athiwat Tiprasaharn Itthidej Aramsri