KiviCare Clinic and Patient Management System Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin, affecting all versions through 4.1.2. The vulnerability arises from a lack of proper authorization on the '/wp-json/kivicare/v1/setup-wizard/clinic' REST API endpoint. This flaw allows unauthenticated attackers to create new clinics and WordPress users with clinic admin rights.

Impact

Exploitation of this vulnerability allows unauthenticated users to gain administrative privileges for a newly created clinic, potentially leading to unauthorized access and modifications within that clinic's management system.

Remediation

Users are advised to update the KiviCare WordPress plugin to version 4.1.3 or later.