Vulnerability Description
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tru
- https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tru
- https://plugins.trac.wordpress.org/changeset/3467409/
- https://www.wordfence.com/threat-intel/vulnerabilities/id/d96743ea-08b1-4b4c-9d6
FAQ
What is CVE-2026-2992?
CVE-2026-2992 is a vulnerability with a CVSS score of 8.2 (HIGH). The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST A...
How severe is CVE-2026-2992?
CVE-2026-2992 has been rated HIGH with a CVSS base score of 8.2/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-2992?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.