CVE-2026-2992

High

Published: 18 March 2026

Published

18 March 2026

Modified

22 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

EPSS Score 0.0025 15.9th percentile

Risk Priority 55 floored blend · peak EPSS

Summary

CVE-2026-2992 is a high-severity Missing Authorization (CWE-862) vulnerability in Wordpress (inferred from references). Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 15.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 AC-2 (Account Management) and AC-3 (Access Enforcement).

Deeper analysis

CVE-2026-2992 is a privilege escalation vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, affecting all versions up to and including 4.1.2. The issue stems from missing authorization checks on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint, as detailed in the plugin's SetupWizardController.php file. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N) and is linked to CWE-862 (Missing Authorization).

Unauthenticated attackers can exploit this vulnerability remotely with low complexity and no privileges required. By sending a crafted request to the vulnerable endpoint, they can create a new clinic within the system and register a WordPress user account endowed with clinic admin privileges, potentially enabling further unauthorized access or control over the clinic management features.

Advisories and references, including the Wordfence threat intelligence page and WordPress plugin trac entries, point to specific code locations in `SetupWizardController.php` (lines 31 and 162) and changeset 3467409, which address the authorization flaw. Security practitioners should update the KiviCare plugin to a version beyond 4.1.2 and review the referenced sources for patch details and verification steps.

OWASP Top 10 for Web (2025)

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-12839

Vulnerability details

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-json/kivicare/v1/setup-wizard/clinic` REST API endpoint in all versions up to, and including, 4.1.2. This makes it possible for…

unauthenticated attackers to create a new clinic and a WordPress user with clinic admin privileges.

CWE(s): CWE-862

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1068 Exploitation for Privilege Escalation Privilege Escalation

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.

attack.mitre.org →

T1136.001 Local Account Persistence

Adversaries may create a local account to maintain access to victim systems.

attack.mitre.org →

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

Why these techniques?

Missing authorization on public REST endpoint directly enables remote unauthenticated creation of privileged WordPress user (T1136.001), which constitutes exploitation of a public-facing application (T1190) for privilege escalation (T1068).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0