KiviCare – Clinic & Patient Management System (EHR), CVE-2026-19416
- CVE, Research URL
- Published on
- Aug 19, 2026
- Research Description
- The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
- Affected versions
-
max 4.5.4.
- Status
-
vulnerable