CVE-2026-2992 is a privilege escalation vulnerability in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin caused by missing authorization checks on the /wp-json/kivicare/v1/setup-wizard/clinic REST API endpoint. This allows unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges, compromising the integrity of the system. The vulnerability affects all versions up to and including 4.1.2 and has a CVSS 3.1 base score of 8.2, indicating high severity. No patch or remediation details are currently available.

An attacker can exploit this vulnerability to escalate privileges by creating a new clinic and a WordPress user with clinic admin rights without authentication. This can lead to unauthorized administrative access to the clinic management system, potentially compromising patient data integrity and system operations. The confidentiality impact is rated low, integrity impact high, and availability impact none according to the CVSS vector.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable REST API endpoint if possible, and monitor for suspicious activity related to user creation. Avoid exposing the setup wizard endpoint publicly. Follow vendor communications closely for updates.