CVE-2026-13611

The KiviCare WordPress plugin prior to version 4.5.5 is vulnerable due to insufficient authorization checks on certain REST endpoints, enabling unauthenticated attackers to access sensitive information such as the patient roster and payment gateway secret key. This vulnerability poses a medium risk, particularly for healthcare providers and organizations using the plugin, as it could lead to unauthorized data exposure and potential financial fraud. Users of the affected plugin should prioritize updating to the latest version to mitigate these risks.