CVE-2026-11990 is an authorization bypass vulnerability (CWE-862) in the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin. The vulnerability exists in all versions up to and including 4.4.0 due to improper authorization checks that allow unauthenticated users to mark pending appointments as confirmed and create forged payment records in the wp_kc_payments_appointment_mappings table using attacker-supplied payment IDs. The exploit is facilitated by the gateway resolution logic which returns all registered gateways regardless of whether they are enabled by the administrator, making the manual (KCPayLater) gateway selectable and bypassing payment requirements.

An attacker can bypass authorization controls to confirm appointments and forge payment records without authentication or payment. This compromises the integrity of appointment and payment data, potentially leading to fraudulent appointment confirmations and financial discrepancies. There is no impact on confidentiality or availability reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, administrators should consider disabling or restricting access to the vulnerable plugin and payment gateways, or applying custom access controls to prevent unauthorized appointment confirmations and payment record modifications.