The KiviCare WordPress plugin is vulnerable to an unauthenticated account creation flaw that allows attackers to obtain administrative access to patient and billing records.

This is an improper privilege management vulnerability (CWE-269) located in the plugin's registration endpoint. The application fails to validate user roles during account creation, allowing an unauthenticated attacker to register a privileged clinic-staff account.

Successful exploitation grants an attacker full access to sensitive EHR data, including patient medical records, clinic administrative data, and billing information. Given the CVSS score of 9.8, this vulnerability poses a severe risk of data breach, regulatory non-compliance, and significant reputational damage to healthcare providers.

Immediate Action: Update the KiviCare plugin to version 4.5.2 or later immediately to enforce proper role validation.

Proactive Monitoring: Review WordPress user registration logs for anomalous account creations, specifically looking for users assigned the clinic-staff or doctor roles that were not manually provisioned by administrators.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules designed to block suspicious registration requests or restrict access to the registration endpoint by IP address if immediate patching is not possible.

Public Exploit Available: Yes, a proof-of-concept is documented in security research sources.

This vulnerability is highly critical due to the ease of exploitation and the sensitivity of the data exposed. Administrators must prioritize updating the KiviCare plugin to version 4.5.2 to remediate this flaw and prevent unauthorized access to patient health information.