CVE-2026-0927 — Missing Authorization in Kivicare Clinic Patient Management System

CWE-862 — Missing Authorization4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.0%
top 90.78%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Iqonicdesign Kivicare Clinic Patient Management System
Timeline
PublishedJan 23

Description

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. This makes it possible for unauthenticated attackers to upload text files and PDF documents to the affected site's server which may be leveraged for further attacks such as hosting malicious content or phishing pages via PDF files.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages1 packages

🔴Vulnerability Details

2
CVEList
KiviCare – Clinic & Patient Management System (EHR) <= 3.6.15 - Missing Authorization to Unauthenticated Limited Arbitrary File Upload↗2026-01-23
▶
GHSA
GHSA-6hx9-j4rp-f38j: The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization chec↗2026-01-23
▶

🕵️Threat Intelligence

1
Wiz
CVE-2026-0927 Impact, Exploitability, and Mitigation Steps | Wiz↗
▶
CVE-2026-0927 — Missing Authorization | cvebase