Cyber Posture

CVE-2026-2991

High

Published: 18 March 2026

Published
18 March 2026
Modified
22 April 2026
KEV Added
—
Patch
—
CVSS Score 7.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
EPSS Score 0.0008 24.4th percentile
Risk Priority 15 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.

Security Summary

CVE-2026-2991, published on 2026-03-18, is an authentication bypass vulnerability (CWE-287) in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, affecting all versions up to and including 4.1.2. The flaw originates in the `patientSocialLogin()` function within the plugin's AuthController.php, which does not verify the social provider access token prior to authenticating a user. This CVSS 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) issue enables attackers to impersonate users without proper credentials.

Unauthenticated remote attackers can exploit the vulnerability by providing only a target patient's email address and an arbitrary access token value via the social login endpoint. Successful exploitation allows login as any registered patient, granting access to sensitive medical records, appointments, prescriptions, and billing information, leading to PII/PHI breaches. Additionally, authentication cookies are set before role checks, resulting in cookies for non-patient users—including administrators—being included in HTTP response headers, even when a 403 Forbidden status is returned.

Advisories from Wordfence detail the vulnerability and reference specific code locations in the plugin's trac repository, including AuthController.php lines 1852 and 284. A fix is implemented in trac changeset 3467409, indicating that updating the plugin beyond version 4.1.2 addresses the issue through proper token verification and role check sequencing.

Details

CWE(s)
CWE-287

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1078 Valid Accounts Stealth
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
attack.mitre.org →
Why these techniques?

The vulnerability is an authentication bypass in a public-facing WordPress plugin (T1190: Exploit Public-Facing Application), enabling unauthenticated attackers to impersonate any registered patient and use valid accounts (T1078: Valid Accounts) to access sensitive data.

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References