A critical privilege escalation vulnerability in the KiviCare WordPress plugin allows unauthenticated attackers to gain administrative access to the system.

The vulnerability stems from a missing authorization check on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint. This flaw allows an unauthenticated attacker to interact with the setup wizard and create a new clinic, which automatically grants the attacker administrative privileges within the WordPress environment.

The ability for an unauthenticated user to elevate their privileges to a clinic administrator constitutes a critical security risk. Successful exploitation could lead to total compromise of the clinic management system, unauthorized access to sensitive patient data, and full control over the WordPress site instance, justifying the high CVSS score of 8.2.

Immediate Action: Update the KiviCare – Clinic & Patient Management System (EHR) plugin to version 4.1.3 or higher immediately to apply the necessary authorization checks.

Proactive Monitoring: Monitor WordPress audit logs for unexpected user account creation events or unusual REST API activity targeting the kivicare setup wizard endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block or rate-limit requests to the /wp-json/kivicare/v1/setup-wizard/ path until the patch is applied.

Public Exploit Available: No — exploit_available (unknown).

This vulnerability represents a significant risk to the integrity and confidentiality of the affected WordPress site. Administrators must prioritize the update of the KiviCare plugin to the latest version to prevent unauthorized administrative account creation. Failure to patch allows any remote attacker to bypass standard security controls and gain persistent, high-level access to the application.