CVE-2026-19416

The KiviCare WordPress plugin (versions before 4.5.4 ) is vulnerable to an Insecure Direct Object Reference (IDOR) flaw. The software fails to verify that the requesting user owns the specific appointment being modified. Consequently, an authenticated patient-level user can cancel or reschedule a...