Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2026-19416 Authenticated Patient Appointment Manipulation in KiviCare WordPress Plugin < 4.5.4 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-19416
Post summary
The post merely references CVE-2026-19416 with a brief description and a link, lacking detailed technical, exploit, or patch information.
🚨*CVE* CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users t… https://www.cve.org/CVERecord?id=CVE-2026-19416 ----- Traducción: CVE-2026-19416 El … https://infoflow.cloud`
Post summary
CVE‑2026‑19416 exposes a missing ownership check in the KiviCare WordPress plugin, letting authenticated patients modify any appointment. This is a new vulnerability disclosure without evidence of active exploitation, PoC, or patch availability.
CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users t… https://www.cve.org/CVERecord?id=CVE-2026-19416
Post summary
The message announces a newly disclosed vulnerability in the KiviCare WordPress plugin that permits certain authenticated users to alter appointments they do not own.