Vendor
The KiviCare WordPress plugin (<= 4.5.1) is vulnerable to unauthenticated account creation via its REST API, allowing attackers to escalate privileges to doctor or receptionist roles and access sensitive patient PHI.