iqonicdesign KiviCare Plugin up to 4.1.2 on WordPress HTTP Response Header patientSocialLogin improper authentication

Summaryinfo

A vulnerability classified as critical was found in iqonicdesign KiviCare Plugin up to 4.1.2 on WordPress. This affects the function patientSocialLogin of the component HTTP Response Header Handler. The manipulation results in improper authentication. This vulnerability is known as CVE-2026-2991. It is possible to launch the attack remotely. No exploit is available.

Detailsinfo

A vulnerability classified as critical has been found in iqonicdesign KiviCare Plugin up to 4.1.2 on WordPress. Affected is the function patientSocialLogin of the component HTTP Response Header Handler. The manipulation with an unknown input leads to a improper authentication vulnerability. CWE is classifying the issue as CWE-287. When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.

The weakness was published by Gibran Abdillah. The advisory is shared for download at wordfence.com. This vulnerability is traded as CVE-2026-2991 since 02/22/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. There are known technical details, but no exploit is available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 03/24/2026).

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• WordPress Plugin

Vendor

• iqonicdesign

Name

• KiviCare Plugin

Version

• 4.1.0
• 4.1.1
• 4.1.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion