CVE-2026-2991

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 4.1.2. This is due to the `patientSocialLogin()` function not verifying the social provider access token before authenticating a user. This makes it possible for unauthenticated attackers to log in as any patient registered on the system by providing only their email address and an arbitrary value for the access token, bypassing all credential verification. The attacker gains access to sensitive medical records, appointments, prescriptions, and billing information (PII/PHI breach). Additionally, authentication cookies are set before the role check, meaning the auth cookies for non-patient users (including administrators) are also set in the HTTP response headers, even though a 403 response is returned.

• CWE-287

• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/api/AuthController.php#L1852
• https://plugins.trac.wordpress.org/browser/kivicare-clinic-management-system/trunk/app/controllers/api/AuthController.php#L284
• https://plugins.trac.wordpress.org/changeset/3467409/
• https://www.wordfence.com/threat-intel/vulnerabilities/id/8d22448b-aa8e-4775-b7c5-e7bae94a3f6d?source=cve

Published

Mar 18, 2026

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-29870A directory traversal vulnerability in the agentic-context-e…7.6
• CVE-2026-29871A path traversal vulnerability exists in the awesome-llm-app…7.5
• CVE-2026-29872A cross-session information disclosure vulnerability exists …8.2
• CVE-2026-2988The Blubrry PowerPress plugin for WordPress is vulnerable to…6.4
• CVE-2026-29905Kirby CMS through 5.1.4 allows an authenticated user with 'E…6.5
• CVE-2026-29909MRCMS V3.1.2 contains an unauthenticated directory enumerati…5.3
• CVE-2026-2992The KiviCare – Clinic & Patient Management System (EHR) plug…8.2
• CVE-2026-29923The pstrip64.sys driver in EnTech Taiwan PowerStrip <=3.90.7…7.8
• CVE-2026-29924Grav CMS v1.7.x and before is vulnerable to XML External Ent…7.6
• CVE-2026-29925Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-…7.7
• CVE-2026-2993The AI Chatbot & Workflow Automation by AIWU plugin for Word…7.5
• CVE-2026-29933A reflected cross-site scripting (XSS) vulnerability in the …6.1