Description
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being served, allowing authenticated patient-level users to download any file in the media library, including other patients' uploaded medical reports.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | KiviCare | < 4.5.4 | 4.5.4 |
References
- https://wpscan.com/vulnerability/4270b160-cbb8-46b2-853c-927651ca16bf/ exploit vdb-entry technical-description