CVE-2026-11990: KiviCare Authorization Bypass Allows Unauthenticated Appointment & Payment Fraud

Technical summary

CVE-2026-11990 is an authorization bypass vulnerability (CWE-862) in KiviCare versions up to 4.4.0 stemming from insufficient access control verification. Unauthenticated attackers can invoke the appointment confirmation endpoint without proper privilege checks, modifying the appointment status to 'Confirmed'. Simultaneously, they can inject arbitrary payment ID values into the wp_kc_payments_appointment_mappings table, simulating a completed payment transaction. The vulnerability is particularly severe because the gateway resolution logic returns all registered payment gateways irrespective of admin configuration flags, meaning the KCPayLater manual payment method remains available for exploitation even when administratively disabled. This allows attackers to completely circumvent the payment validation workflow on default configurations.

Business impact

Healthcare providers using KiviCare face revenue loss through appointment fraud—attackers can confirm appointments and bypass payment obligations entirely. Patient trust and data integrity are at risk if appointment records are manipulated by unauthorized parties. Compliance implications may arise if patient scheduling records are altered without audit trails. The reputational damage from a breach involving patient-facing scheduling and payment systems could be significant, particularly for smaller clinics lacking robust compensating controls.

Affected systems

WordPress installations running the KiviCare plugin in any version up to and including 4.4.0 are affected. The vulnerability is exploitable on default installations without additional configuration or authentication. Any clinic or healthcare provider deploying KiviCare for appointment and payment management is at risk.

Exploitability

Exploitability is high due to the unauthenticated, network-accessible nature of the vulnerability. No authentication is required, the attack has low complexity (straightforward HTTP requests to appointment and payment endpoints), and no user interaction is needed. The manual payment gateway is enabled by default regardless of administrator preferences, making the attack viable on standard deployments immediately upon installation. The CVSS 3.1 score of 5.3 (Medium) reflects integrity impact (forged payments) without confidentiality or availability loss, but the practical business risk is substantial.

Remediation

Immediately update KiviCare to a patched version released after 4.4.0. Verify the specific version number against the KiviCare security advisories on WordPress.org. As a temporary compensating control pending patch deployment, restrict access to the KiviCare appointment and payment endpoints at the web server or WAF level to trusted IP ranges if operationally feasible. Audit wp_kc_payments_appointment_mappings for suspicious payment records created before patching and reconcile against actual payments received.

Patch guidance

Check the KiviCare plugin repository on WordPress.org for version 4.4.1 or later, which should address the authorization bypass. Verify the patch notes confirm fixes to both appointment confirmation access control and payment gateway enumeration. Apply the update through the WordPress admin dashboard once available, and perform a brief smoke test on the appointment booking and payment flow. If a patch is not yet available, contact KiviCare support for an estimated timeline and interim security recommendations.

Detection guidance

Monitor web server and application logs for POST requests to appointment confirmation endpoints (typically /wp-admin/admin-ajax.php with actions related to appointment status updates) originating from unauthenticated sessions. Flag any writes to wp_kc_payments_appointment_mappings table where no corresponding transaction log or payment gateway confirmation exists. Query WordPress user metadata to identify any appointment records modified by unauthenticated users or system processes. Implement alerting on bulk appointment status changes in short time windows, which may indicate automated exploitation. Review audit logs for payment records with manually-assigned payment IDs that do not match legitimate gateway transaction references.

Why prioritize this

Although rated CVSS 5.3 (Medium), this vulnerability warrants high prioritization because it directly enables revenue theft and patient record manipulation in a healthcare context. The attack requires no authentication, has low complexity, and is readily exploitable on default installations. For any organization running KiviCare, this should be patched immediately or mitigated with access controls. The integrity impact to patient-facing systems and financial records elevates practical risk beyond the numerical score.

Risk score, explained

The CVSS 5.3 score reflects the integrity impact (forged payments) and network-accessible unauthenticated attack vector. However, the score does not fully capture the business and compliance consequences of allowing attackers to manipulate healthcare appointment and payment records. The lack of confidentiality or availability impact caps the severity score, but organizations should interpret this vulnerability as a critical business risk and prioritize patching accordingly.

Frequently asked questions