CVE-2026-13610

The KiviCare WordPress plugin prior to version 4.5.2 is vulnerable due to its lack of role restrictions on the unauthenticated registration endpoint, enabling attackers to create privileged clinic-staff accounts. This flaw can lead to unauthorized access to sensitive patient records, billing, and clinic data. WordPress site administrators using this plugin should prioritize updating to the latest version to mitigate potential data breaches.