Is CVE-2026-13611 being exploited?

No public exploit is currently tracked.

How severe is CVE-2026-13611?

CVE-2026-13611 has a CVSS v3 severity of MEDIUM (5.3).

Back

CVE-2026-13611

Description

The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.