CVE-2026-2992

High

Published: 18 March 2026

Published

18 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS Score 0.0007 20.8th percentile

Risk Priority 16 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2992 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 20.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Privilege Escalation (T1068) and 2 other techniques. What defenders deploy: see the NIST 800-53 controls recommended below.

Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

AC-3 Access Enforcement good match

prevent

Enforces authorization checks on the REST API endpoint to prevent unauthenticated attackers from creating clinics and privileged WordPress users.

AC-2 Account Management good match

prevent

Manages account creation processes to ensure only authorized entities can register WordPress users with clinic admin privileges.

AC-6 Least Privilege partial match

prevent

Limits privileges of any created accounts to the minimum necessary, reducing the impact of unauthorized privilege escalation.

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1136.001 Local Account Persistence

Adversaries may create a local account to maintain access to victim systems.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization on public REST endpoint directly enables remote unauthenticated creation of privileged WordPress user (T1136.001), which constitutes exploitation of a public-facing application (T1190) for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

NVD Description

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for…

unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

Deeper analysisAI

CVE-2026-2992 is a privilege escalation vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, affecting all versions up to and including 4.1.2. The issue stems from missing authorization checks on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint, as detailed in the plugin's SetupWizardController.php file. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) and is linked to CWE-862 (Missing Authorization).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending a crafted request to the vulnerable endpoint, they can create a new clinic within the system and register a WordPress user account endowed with clinic admin privileges, potentially enabling further unauthorized access or control over the clinic management features.

Advisories and references, including the Wordfence threat intelligence page and WordPress plugin trac entries, point to specific code locations in `SetupWizardController.php` (lines 31 and 162) and changeset 3467409, which address the authorization flaw. Security practitioners should update the KiviCare plugin to a version beyond 4.1.2 and review the referenced sources for patch details and verification steps.