PT-2026-4325 · WordPress · Kivicare – Clinic & Patient Management System

Sarawut Poolkhet · Published 2026-01-23 · Updated 2026-01-23 · CVE-2026-0927

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress versions through 3.6.15

Description The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is susceptible to unauthorized file uploads. This is due to a lack of proper authorization checks within the uploadMedicalReport() function. This allows unauthenticated attackers to upload text files and PDF documents to the server. Successful exploitation could lead to hosting malicious content or phishing pages through uploaded PDF files.

Recommendations Update KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress to a version later than 3.6.15.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2026-0927

Affected Products

Kivicare – Clinic & Patient Management System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2026-0927 · Security Note
• https://twitter.com/VulmonFeeds/status/2014612157053161638 · Twitter Post
• https://plugins.trac.wordpress.org/changeset/3443088/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php · Note
• https://t.me/cveNotify/149652 · Telegram Post
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/3.6.15/app/controllers/KCAppointmentController.php#L1328 · Note
• https://t.me/CVEtracker/42814 · Telegram Post
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/KCAppointmentController.php#L1328 · Note
• https://twitter.com/CVEnew/status/2014576937180746149 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/489931ef-bac3-4de8-84ec-6f226d96f778?source=cve · Note