CVE-2026-13610

CVE-2026-13610 is an unauthenticated role parameter injection vulnerability in KiviCare, a WordPress plugin for clinic management. The registration endpoint accepts a role parameter and passes it directly to user creation functions without authentication or server-side validation, allowing any unauthenticated requester to register as an administrator or any other WordPress role. The vulnerable endpoint exists in versions prior to 4.5.2. The immediate technical check: verify whether your KiviCare installation exposes a registration endpoint at `/wp-json/kivicare-api/v1/register` or similar paths, and confirm whether requests to this endpoint can include a role parameter that gets honored without authentication. If role parameter injection works, you have this vulnerability. This vulnerability isn't a simple oversight — the endpoint accepts and processes a role parameter by design, meaning that capability shipped to production as part of the registration workflow. The developers likely built it for convenience (clinic admins registering staff), and the WordPress role system may have created false confidence that capabilities were gated elsewhere. The plugin architecture made insecure implementation the path of least resistance. This is a known vulnerability genotype: similar flaws appeared in LearnPress (CVE-2021-4429), Ultimate Member (CVE-2021-24911), and other WordPress plugins handling registration flows. The CVSS 7.5 score significantly understates the real risk in production environments. KiviCare manages clinical workflows, patient records, billing data, and staff credentials — a compromised administrator account doesn't just gain WordPress admin access, it becomes a pivot point into an ecosystem handling protected health information. Medical records have sensitivity windows measured in decades, and stolen PHI enables insurance fraud, identity theft, and referral network abuse. The CVSS number measures technical exploitability, not data sensitivity or regulatory exposure. For a clinic running this plugin, the severity is materially higher than the base score suggests. Remediation priority: patch to 4.5.2 or later immediately. The fix strips the role parameter from the registration endpoint and enforces server-side role assignment. But understand that healthcare WordPress deployments are notoriously resistant to routine updates — EHR integrations, appointment sync workflows, and billing module dependencies create friction against patching. If you cannot update immediately, restrict the registration endpoint at the web server level (require IP allowlisting or VPN access), or disable the API endpoint entirely if patient self-registration isn't a required workflow. Beyond patching, hunt your environment for other WordPress plugins handling registration, role assignment, or user creation where role parameters might be passed from client input. The genotype is well-documented across the WordPress ecosystem, and this won't be the last time this pattern appears. Consider implementing a code review checklist item specifically flagging any user registration handler that accepts role parameters from request input.

Reviewed through automated stages and approved by a human before publication.