CVE-2026-19417CWE-639
CVE-2026-19417
Medium · published August 19, 2026
What it is
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
The record
Technical detail
- CVSS v3.1
- 6.5 · MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CVSS v4.0
- Not supplied
- EPSS
- 0.00340 · 26.3th percentile
- Weakness
- CWE-639 · Authorization Bypass Through User-Controlled Key
- Published
- 2026-08-19T10:17Z
References (1)
EPSS history
Timeline