CVE-2026-2992: 
WordPress vulnerability analysis and mitigation

CVE-2026-2992 is a privilege escalation vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, caused by missing authorization on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint. It affects all versions of the plugin up to and including 4.1.2, allowing unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges. The vulnerability was published on March 18, 2026, and was assigned by Wordfence. It carries a CVSS v3.1 base score of 8.2 (High) (Wordfence, Red Hat CVE).

The root cause is CWE-862 (Missing Authorization) on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint within the plugin's SetupWizardController.php file. Because no authentication or capability check is enforced on this endpoint, any unauthenticated network attacker can send a crafted HTTP POST request to register a new clinic and simultaneously create a WordPress user account with clinic admin privileges. The vulnerable code paths are visible in the plugin's source at lines 31 and 162 of SetupWizardController.php (Wordfence, WordPress Trac). No special preconditions or prior access are required — the attack is fully unauthenticated and low-complexity.

Successful exploitation allows an unauthenticated attacker to gain clinic admin-level access to the WordPress installation, enabling unauthorized modification of clinic data, access to sensitive patient health records (EHR), and potential further compromise of the WordPress site. The integrity impact is high, as attackers can create privileged accounts and alter clinic configurations, while there is also a low confidentiality impact due to potential exposure of patient information. Availability is not directly impacted, but the creation of rogue admin accounts could facilitate persistent access and broader site takeover (Wordfence).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The vulnerability has an EPSS score of approximately 0.036%, indicating a low (but non-zero) probability of exploitation in the near term. The CVE is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was detected by Qualys application security scanning (Qualys). No threat actor attribution has been reported.

1. Reconnaissance: Identify WordPress sites running the KiviCare plugin (versions ≤ 4.1.2) using tools like WPScan, Shodan, or by checking publicly accessible plugin metadata at /wp-content/plugins/kivicare-clinic-management-system/readme.txt.
2. Confirm endpoint availability: Send a GET or OPTIONS request to https://target.example.com/wp-json/kivicare/v1/setup-wizard/clinic to confirm the endpoint is accessible and returns a response (no authentication challenge).
3. Craft malicious POST request: Construct an HTTP POST request to the endpoint with a JSON body containing the desired clinic name and new admin user credentials (username, email, password).
4. Submit request: Send the unauthenticated POST request. The server processes it without any authorization check, creating a new clinic entry and a WordPress user account with clinic admin privileges.
5. Authenticate as new admin: Log in to the WordPress site using the newly created credentials, gaining full clinic admin access to patient records, clinic settings, and potentially broader WordPress administrative functions (Wordfence, WordPress Trac).

• Network: Unexpected POST requests to /wp-json/kivicare/v1/setup-wizard/clinic from unknown or external IP addresses, especially without prior authentication cookies or nonces.
• Logs: WordPress access logs showing POST requests to the setup-wizard clinic endpoint from unauthenticated sessions; repeated or automated requests to this endpoint in a short timeframe.
• WordPress Admin: Newly created WordPress user accounts with clinic admin roles that were not provisioned by legitimate administrators; unexpected new clinic entries in the KiviCare dashboard.
• File System: No direct file system artifacts expected, but monitor for subsequent webshell uploads or plugin/theme modifications by the rogue admin account.

The recommended remediation is to upgrade the KiviCare plugin beyond version 4.1.2 as soon as a patched release is available (changeset 3467409 in the WordPress plugin repository addresses this issue) (WordPress Trac). As an interim workaround, administrators should restrict or block access to the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint at the web server or WAF level. Additionally, implement WordPress REST API authentication controls and monitor WordPress user creation logs for unauthorized clinic admin accounts. Review existing user accounts for any suspicious additions and remove unauthorized entries immediately (Wordfence).

Wordfence disclosed and assigned this CVE, publishing it in their weekly WordPress vulnerability report for the week of March 16–22, 2026 (Wordfence Blog). The vulnerability was also picked up by automated security aggregators including RedPacket Security and CVEFeed.io shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified beyond standard vulnerability aggregation.