CVE-2026-13611

5.3 mediumEPSS 0.3%

Medium (5.3). EPSS 0.3% chance of exploitation in the next 30 days.

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

EPSS: 0.3% chance of exploitation in the next 30 days; higher than 25% of CVEs (scores of 2026-10-31)
CWEs: CWE-200, CWE-862
Published: 2026-09-01
Modified: 2026-09-01
Record from: the NVD, synced 2026-10-19

References

https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/

Check your stack JSON