{"id":"CVE-2026-13612","aliases":["EUVD-2026-57076","GHSA-f444-wc3x-6c2g"],"status":"published","title":"KiviCare \u003c 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR","description":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00254,"percentile":0.1713,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639"],"published":"2026-08-12T06:00:12Z","modified":"2026-08-26T16:30:52Z","products":[{"vendor":"iqonic design","product":"kivicare"},{"vendor":"unknown","product":"kivicare"}],"references":[{"url":"https://wpscan.com/vulnerability/0f48c1a3-d1f2-4028-b864-190c7f58becd/","tags":["exploit","vdb-entry","technical-description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13612"},{"url":"https://wpscan.com/vulnerability/0f48c1a3-d1f2-4028-b864-190c7f58becd"},{"url":"https://github.com/advisories/GHSA-f444-wc3x-6c2g"}],"sources":{"cve":[{"id":"CVE-2026-13612","title":"KiviCare \u003c 4.5.2 - Patient+ Cross-Patient Bill, Invoice and Appointment Disclosure via IDOR","description":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.","status":"published","published":"2026-08-12T06:00:12.393Z","modified":"2026-08-13T15:51:42.869Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:19:49.885652Z"}],"euvd":[{"id":"EUVD-2026-57076","description":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.","status":"published","published":"2026-08-12T06:00:12Z","modified":"2026-08-13T15:51:42Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:01:55.61982Z"}],"ghsa":[{"id":"GHSA-f444-wc3x-6c2g","title":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the...","description":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.","status":"published","published":"2026-08-12T06:30:49Z","modified":"2026-08-13T18:31:24Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T15:10:25.845105Z"}],"nvd":[{"id":"CVE-2026-13612","description":"The KiviCare  WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details.","status":"published","published":"2026-08-12T06:17:29.577Z","modified":"2026-08-26T16:30:52.723Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:12:36.880938Z"}]}}