Unrestricted Role Assignment in WordPress Plugin Registration

The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated registration endpoint, allowing unauthenticated attackers to create an active, privileged clinic-staff (doctor) account with full access to patient records, billing and clinic data.

Casky was already ahead

This CVE exploits attack patterns that Casky's 224matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-13610 exploits a critical privilege escalation flaw in the KiviCare WordPress plugin's unauthenticated registration endpoint. By failing to enforce role restrictions during account creation, attackers can register themselves with elevated clinic-staff (doctor) credentials without authentication. This vulnerability directly threatens healthcare organizations running KiviCare, exposing sensitive patient records, billing information, and clinic operational data to unauthorized access. The attack requires no prior credentials or social engineering—any unauthenticated user can escalate to privileged status, making this a particularly dangerous vector for healthcare data breaches and compliance violations (HIPAA, GDPR).

Casky's 224 matched security skills map this vulnerability to MITRE ATT&CK technique TA0004 (Privilege Escalation), enabling practitioners to detect the attack patterns through Claude's extended reasoning capabilities. Practitioners using Casky would identify suspicious account creation patterns: unauthenticated registration requests that assign elevated roles, anomalous doctor-account creations lacking proper enrollment workflows, and rapid access to patient data from newly created accounts. The platform's skill correlation would flag improper input validation on role parameters, missing authentication checks on privileged account endpoints, and authorization bypass indicators. Security teams would see findings highlighting the CWE-269 (Improper Access Control) root cause and receive actionable detection strategies—such as monitoring registration endpoint logs for role-assignment attempts, validating account creation workflows, and implementing role-based access control enforcement at the application layer.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

224 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-13610.

abusing-dpapi-for-credential-access

red teaming · high

Run

abusing-shadow-credentials-for-privesc

red teaming · high

Run

Access with Stolen Session Cookie

penetration testing · medium

Run

MITRE ATT&CK Techniques

TA0004

Investigate the attack patterns behind CVE-2026-13610

Casky has 224 skills that investigate the attack patterns behind CVE-2026-13610. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn