CVE-2026-19416

KiviCare WordPress plugin before 4.5.4 suffers an IDOR flaw: appointment cancellation/rescheduling endpoints lack ownership checks, letting authenticated patient-level users cancel or reschedule other patients' appointments. Upgrade to 4.5.4 to resolve. No in-the-wild exploitation details are pro...