The KiviCare Clinic & Patient Management System (EHR) WordPress plugin suffers from an authentication bypass vulnerability (CWE-287) due to improper verification of social login access tokens in the patientSocialLogin() function. This allows unauthenticated attackers to impersonate any patient by providing only the patient's email and an arbitrary access token, bypassing all credential verification. The vulnerability also causes authentication cookies for all roles, including administrators, to be set before role checks, potentially exposing session cookies despite access denial. The issue affects all versions up to 4.1.2 and has a CVSS 3.1 base score of 7.3, indicating high severity. No known exploits in the wild or patches are currently documented.

Successful exploitation allows unauthenticated attackers to bypass authentication controls and gain access to sensitive patient information such as medical records, appointments, prescriptions, and billing data, resulting in a breach of personally identifiable information (PII) and protected health information (PHI). Additionally, the premature setting of authentication cookies for all user roles, including administrators, may increase the risk of session-related attacks or unauthorized access attempts. The overall impact includes confidentiality, integrity, and availability losses rated as low to high respectively per the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict access to the affected plugin or disable it if possible. Monitor for updates from the vendor iqonicdesign regarding patches or official mitigations. Avoid relying on the vulnerable social login functionality to prevent unauthorized access.