Exploitation Research Plan: CVE-2026-25034 (KiviCare Missing Authorization)

1. Vulnerability Summary

The KiviCare – Clinic & Patient Management System (EHR) plugin (<= 3.6.16) contains a "Missing Authorization" vulnerability. This occurs because specific administrative or state-changing functions registered via WordPress AJAX (wp_ajax_ and wp_ajax_nopriv_) or the REST API lack proper capability checks (current_user_can()) or permission callbacks. Consequently, unauthenticated attackers can perform unauthorized actions, such as modifying appointment statuses, changing clinic settings, or manipulating user records.

2. Attack Vector Analysis

• Target Endpoint: /wp-admin/admin-ajax.php
• Vulnerable Action: kivicare_update_appointment_status (or potentially kivicare_discard_appointment or kivicare_save_appointment_widget_setting).
• HTTP Method: POST
• Authentication: None (Unauthenticated).
• Parameters:
  • action: kivicare_update_appointment_status
  • appointment_id: The ID of the appointment to modify.
  • status: The new status (e.g., cancelled, confirmed, checkout).
  • _wpnonce or kc_nonce: A valid nonce (if enforced, though often bypassed or publicly exposed).

3.