CVE-2026-0927: 
WordPress vulnerability analysis and mitigation

CVE-2026-0927 is a missing authorization vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress that allows unauthenticated attackers to upload arbitrary text files and PDF documents to the affected server. The flaw exists in the uploadMedicalReport() function and affects all plugin versions up to and including 3.6.15. It was published on January 23, 2026, with the CVE record sourced from Wordfence. The vulnerability carries a CVSS v3.1 base score of 5.3 (Medium), assigned by Wordfence (Wordfence, Red Hat CVE).

The root cause is classified as CWE-862 (Missing Authorization): the uploadMedicalReport() function in KCAppointmentController.php does not perform any authentication or authorization checks before processing file upload requests, allowing any unauthenticated network user to invoke it (Wordfence). The attack vector is network-based, requires no privileges or user interaction, and has low attack complexity. Exploitation is limited to uploading text files and PDF documents — executable file types (e.g., PHP shells) are not permitted by the function — but the uploaded content can be used to host phishing pages or malicious PDFs on the target server. The vulnerable code is visible in the plugin's source repository at line 1328 of KCAppointmentController.php (WordPress Trac).

Successful exploitation allows unauthenticated attackers to upload text or PDF files to the WordPress server's file system, with no direct impact on confidentiality or availability (CVSS integrity impact: Low). The primary risk is secondary: uploaded PDFs can be used to host phishing pages, distribute malware to site visitors, or serve as a staging point for social engineering campaigns. While direct remote code execution is not achievable through this vector alone, the ability to place attacker-controlled content on a trusted domain may facilitate further attacks against end users (Wordfence).

No public proof-of-concept exploit code or evidence of in-the-wild exploitation has been reported for CVE-2026-0927. The EPSS score is approximately 0.048% (0.000480), indicating a very low probability of exploitation in the near term (Red Hat CVE). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been identified.

1. Reconnaissance: Identify WordPress sites running the KiviCare plugin (versions ≤ 3.6.15) using tools like WPScan, Shodan, or by checking the plugin's readme.txt file at https://target.com/wp-content/plugins/kivicare-clinic-management-system/readme.txt.
2. Locate the vulnerable endpoint: Identify the WordPress REST API or AJAX endpoint that maps to the uploadMedicalReport() function in KCAppointmentController.php.
3. Craft the upload request: Prepare a multipart HTTP POST request containing a text file or PDF document (e.g., a phishing page embedded in a PDF) targeting the vulnerable endpoint, with no authentication headers or nonce required.
4. Submit the request: Send the unauthenticated POST request to the target endpoint. The server processes the upload without authorization checks and stores the file on the server.
5. Leverage the uploaded file: Retrieve the URL of the uploaded file and use it to distribute phishing links, host malicious PDF content, or conduct further social engineering against site visitors (Wordfence, WordPress Trac).

• Network: Unauthenticated HTTP POST requests to the KiviCare plugin's medical report upload endpoint (e.g., WordPress AJAX or REST API routes associated with uploadMedicalReport), particularly from unexpected or foreign IP addresses.
• File System: Unexpected .txt or .pdf files appearing in the WordPress uploads directory (typically wp-content/uploads/) with names or content inconsistent with legitimate patient records; files containing embedded URLs, JavaScript, or phishing content.
• Logs: Web server access logs showing POST requests to the KiviCare upload endpoint with HTTP 200 responses from unauthenticated sessions (no valid session cookie or nonce); repeated upload attempts from the same IP address.
• Process/Application: WordPress media library entries for files not associated with any registered patient or appointment record.

Users should update the KiviCare – Clinic & Patient Management System (EHR) plugin to a version beyond 3.6.15, which includes the authorization fix applied in the changeset to KCAppointmentController.php (WordPress Trac Changeset). As a temporary workaround, site administrators can restrict access to the vulnerable upload endpoint via web application firewall (WAF) rules or by blocking unauthenticated POST requests to the relevant plugin endpoint at the server or network level. Regularly auditing the WordPress uploads directory for unexpected files is also recommended.

The vulnerability was discovered and reported by Wordfence, which published the advisory and assigned the CVSS score (Wordfence). Coverage has been limited to automated vulnerability aggregators and security databases, with no notable independent researcher commentary or significant social media discussion identified.