CVE-2026-11990

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to mark arbitrary pending appointments as Confirmed and forge an associated completed payment record in wp_kc_payments_appointment_mappings using an attacker-supplied payment ID, bypassing payment entirely. This exploit is achievable on a default installation because the gateway resolution logic returns all registered gateways regardless of admin-enabled status, making the manual (KCPayLater) gateway always selectable.

• CWE-862

• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/baseClasses/KCPaymentGatewayFactory.php#L131
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/controllers/api/AppointmentsController.php#L3931
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/controllers/api/AppointmentsController.php#L465
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/paymentGateways/KCPayLater.php#L109
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.3.0/app/services/KCAppointmentPaymentService.php#L32
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/baseClasses/KCPaymentGatewayFactory.php#L131
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/controllers/api/AppointmentsController.php#L3931
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/controllers/api/AppointmentsController.php#L465
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/paymentGateways/KCPayLater.php#L109
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/tags/4.4.0/app/services/KCAppointmentPaymentService.php#L32
• https://plugins.trac.wordpress.org/changeset?reponame=&old=3599918%40kivicare-clinic-management-system&new=3599918%40kivicare-clinic-management-system
• https://www.wordfence.com/threat-intel/vulnerabilities/id/efe4223a-5c1a-401e-a46b-0278e96d2d71?source=cve

Published

Jul 10, 2026

Last Modified

Jul 10, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11983The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPr…5.3
• CVE-2026-11985On the Zephyr ARM port, enabling the hardware FPU (CONFIG_FP…3.6
• CVE-2026-11986A flaw was found in the admin-ui-ext component of Keycloak, …4.9
• CVE-2026-11987The Dokan: AI Powered WooCommerce Multivendor Marketplace So…4.3
• CVE-2026-11988The LearnPress – WordPress LMS Plugin for Create and Sell On…6.5
• CVE-2026-11989The Bit integrations – Form Integration, Webhook, Spreadshee…6.5
• CVE-2026-11992The Easy Appointments plugin for WordPress is vulnerable to …4.3
• CVE-2026-11994Akaunting 3.1.21 contains an authenticated stored Cross-Site…4.8
• CVE-2026-11995The Gutena Forms – Contact Form, Survey Form, Feedback Form,…5.3
• CVE-2026-11997The Bulk SEO Image plugin for WordPress is vulnerable to Cro…4.3
• CVE-2026-11998A flaw in AngularJS' Strict Contextual Escaping (SCE) logic …7.6
• CVE-2026-11999X.509 trust-chain bypass (path-depth exhaustion) in the Open…7.5