CVE-2026-0927
📋 TL;DR
The KiviCare WordPress plugin allows unauthenticated attackers to upload arbitrary text and PDF files due to missing authorization checks. This affects all WordPress sites using KiviCare versions up to 3.6.15. Attackers can upload malicious files that could be used for phishing or hosting harmful content.
💻 Affected Systems
- KiviCare – Clinic & Patient Management System (EHR) WordPress plugin
⚠️ Manual Verification Required
This CVE does not have specific version information in our database, so automatic vulnerability detection cannot determine if your system is affected.
Why? The CVE database entry doesn't specify which versions are vulnerable (no version ranges provided by the vendor/NVD).
🔒 Custom verification scripts are available for registered users. Sign up free to download automated test scripts.
- Review the CVE details at NVD
- Check vendor security advisories for your specific version
- Test if the vulnerability is exploitable in your environment
- Consider updating to the latest version as a precaution
⚠️ Risk & Real-World Impact
Worst Case
Attackers upload malicious PDFs containing phishing links or malware, compromising user data and site integrity, potentially leading to complete site takeover if combined with other vulnerabilities.
Likely Case
Attackers upload phishing PDFs or text files containing malicious links, potentially tricking users into revealing credentials or downloading malware.
If Mitigated
With proper file validation and authorization, only legitimate medical reports from authenticated users are uploaded, maintaining normal functionality.
🎯 Exploit Status
The vulnerability is straightforward to exploit as it requires no authentication and involves simple file upload requests.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.6.16 or later
Vendor Advisory: https://plugins.trac.wordpress.org/changeset/3443088/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php
Restart Required: No
Instructions:
1. Log into WordPress admin panel. 2. Navigate to Plugins > Installed Plugins. 3. Find KiviCare plugin and click 'Update Now'. 4. Verify version is 3.6.16 or higher.
🔧 Temporary Workarounds
Disable KiviCare Plugin
allTemporarily deactivate the vulnerable plugin until patched.
wp plugin deactivate kivicare-clinic-management-system
Restrict File Uploads via .htaccess
linuxBlock uploads to the medical report directory for unauthenticated users.
<FilesMatch "\.(txt|pdf)$">
Order Deny,Allow
Deny from all
</FilesMatch>
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block unauthorized file upload requests.
- Monitor server logs for unusual file upload activity to the KiviCare upload directory.
🔍 How to Verify
Check if Vulnerable:
Check WordPress admin panel > Plugins > KiviCare version. If version is 3.6.15 or lower, system is vulnerable.Check Version:
wp plugin get kivicare-clinic-management-system --field=versionVerify Fix Applied:
After updating, confirm KiviCare version is 3.6.16 or higher in WordPress plugins list.📡 Detection & Monitoring
Log Indicators:
- Unusual POST requests to /wp-admin/admin-ajax.php with action=uploadMedicalReport from unauthenticated IPs
- Unexpected .txt or .pdf files appearing in wp-content/uploads/kivicare/medical_report directory
Network Indicators:
- HTTP POST requests to upload endpoints without authentication headers
- File uploads with unusual filenames or extensions
SIEM Query:
source="web_server_logs" AND (uri="/wp-admin/admin-ajax.php" AND method="POST" AND params.action="uploadMedicalReport") AND NOT (user_agent="WordPress/*")🔗 References
- https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/3.6.15/app/controllers/KCAppointmentController.php#L1328
- https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php#L1328
- https://plugins.trac.wordpress.org/changeset/3443088/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/489931ef-bac3-4de8-84ec-6f226d96f778?source=cve
