CVE-2026-13610 is a privilege management vulnerability in the KiviCare WordPress plugin prior to version 4.5.2. The flaw arises because the unauthenticated registration endpoint fails to restrict which roles can be assigned during account creation. This allows unauthenticated attackers to create active accounts with elevated privileges, specifically clinic-staff (doctor) roles, granting full access to sensitive patient and clinic information.

An attacker can create an active privileged user account without authentication, leading to unauthorized access to patient records, billing information, and clinic data. This compromises confidentiality and integrity of sensitive healthcare information and could lead to further unauthorized actions within the affected system.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the registration endpoint or disable unauthenticated registrations to prevent exploitation.