Description

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-19T06:17:39.810Z",
  "pubdate": "2026-08-19T06:17:39.810Z",
  "executiveSummary": "An authorization bypass vulnerability exists within the KiviCare WordPress plugin prior to version 4.5.4, classified as an Insecure Direct Object Reference (IDOR) or broken object level authorization issue. The root cause stems from the application failing to cryptographically or logically verify that the authenticated user initiating an appointment modification request actually owns or possesses the administrative privileges over the targeted appointment record. Consequently, low-privileged authenticated users, specifically those assigned the patient role, can successfully execute unauthorized operations against arbitrary appointments belonging to other system users. The primary impact includes complete loss of confidentiality and integrity regarding scheduling data, as malicious actors can arbitrarily alter or terminate external patient consultations, leading to severe operational disruption, denial of service within clinical workflows, and potential violations of healthcare data privacy regulations. Exploitation of this vulnerability requires network access to the target WordPress instance, an active low-privileged authenticated session as a patient-level user, and the ability to craft or intercept HTTP requests targeting appointment modification endpoints with manipulated appointment identifiers. Remediation requires updating the KiviCare plugin to version 4.5.4 or later, where proper server-side ownership validation logic has been implemented.",
  "technicalDetails": "The vulnerability resides in the access control validation logic of the KiviCare WordPress plugin affecting versions prior to 4.5.4. Specifically, the appointment management component fails to perform adequate session-to-record validation when handling requests to cancel or reschedule appointments. When an authenticated user submits an HTTP request to modify an appointment, the backend controller processes the input parameter denoting the target appointment identifier without validating whether the currently authenticated user session corresponds to the patient or practitioner authorized to manage that specific record.\nThe root cause is the absence of robust server-side ownership checks (Broken Object Level Authorization). The application relies solely on the presence of a valid session cookie or authentication token proving the user is authenticated, but fails to cross-reference the user identifier obtained from the session context against the foreign key linking the appointment record to its rightful owner in the underlying database.\nThe attack flow proceeds as follows: First, an attacker authenticates to the WordPress platform using a legitimate, low-privileged patient-level account. Second, the attacker interacts with the legitimate appointment interface or captures outgoing HTTP traffic via an interception proxy during normal application usage. Third, the attacker identifies the parameter containing the unique appointment identifier (such as an integer ID or UUID) associated with their own appointment. Fourth, the attacker systematically modifies this identifier value within the HTTP request payload to target the appointment ID of another patient. Fifth, the manipulated HTTP request is transmitted to the vulnerable server-side endpoint responsible for rescheduling or cancelling appointments. Sixth, due to the lack of authorization validation, the application processes the request, updates the database state to modify or cancel the victim's appointment, and returns a success response to the attacker. Post-exploitation impact encompasses unauthorized data tampering, systemic disruption of medical scheduling workflows, targeted denial of service against specific patients or practitioners, and potential exposure of sensitive scheduling metadata depending on the breadth of the manipulated parameters."
}