Description

The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-19T06:17:40.043Z",
  "pubdate": "2026-08-19T06:17:40.043Z",
  "executiveSummary": "The KiviCare WordPress plugin, specifically versions prior to 4.5.4, suffers from an authorization bypass vulnerability that impacts the media file retrieval mechanism. This security flaw stems from an absolute lack of access control validation, failing to verify whether a requesting user possesses the explicit authorization or ownership rights required to access a specific media asset. Consequently, the vulnerability enables authenticated users assigned to the patient-level role to execute arbitrary file downloads across the entire WordPress media library. The business impact is severe, as it directly exposes sensitive, private health data, including confidential medical reports and diagnostic documents uploaded by other patients. The risk profile is heightened by the minimal attacker capabilities required: an adversary only needs standard, low-privilege authenticated access to the application to initiate unauthorized data retrieval. Exploitation conditions rely strictly on the attacker holding a valid patient account, bypassing any complex preconditions or administrative privileges. This design flaw severely undermines confidentiality boundaries within multi-user healthcare environments managed by the plugin, facilitating unauthorized mass data harvesting of sensitive Protected Health Information (PHI).",
  "technicalDetails": "The vulnerability resides within the media serving functionality of the KiviCare WordPress plugin, which fails to enforce robust access control checks prior to delivering requested files. In secure architectures, endpoints or handler functions responsible for serving sensitive resources must execute explicit authorization logic to validate that the current session context maps to an entity authorized to view the resource. In the case of KiviCare prior to version 4.5.4, the vulnerable component processes download requests for media library assets without confirming whether the requesting user context—specifically an authenticated patient-level account—owns the targeted file or holds administrative privileges. Attack flow begins when an authenticated patient crafts a direct request to the media serving endpoint. Due to the absence of input validation regarding file ownership and user entitlement, the application proceeds to fetch and stream the requested file from the server's storage without restriction. By systematically iterating through file identifiers, numerical sequences, or predictable storage paths within the media library, an attacker can harvest sensitive documents belonging to other users. The root cause is categorized as an Insecure Direct Object Reference (IDOR) or missing function-level access control, where input parameters designating specific media files are accepted and processed unconditionally. Network exposure is standard HTTP/HTTPS as exposed by the WordPress instance running the affected plugin. Post-exploitation impact is characterized by an extensive breach of data confidentiality, exposing Personally Identifiable Information (PII) and confidential medical records, thereby violating compliance standards and data privacy regulations. The vulnerability affects all KiviCare WordPress plugin iterations prior to version 4.5.4."
}