Authentication Bypass in KiviCare WordPress Plugin Social Login

This repository contains a real Python proof-of-concept exploit for CVE-2026-2991 affecting the KiviCare Clinic & Patient Management System WordPress plugin <= 4.1.2. The main exploit file is CVE-2026-2991.py, which uses the requests library to interact directly with the KiviCare REST API. Its workflow is straightforward: verify the KiviCare namespace is reachable at /wp-json/kivicare/v1/, then send a crafted POST request to /wp-json/kivicare/v1/auth/patient/social-login using only a target email address, a claimed social provider (google or apple), and a hardcoded fake token. The script interprets 200 responses as successful patient impersonation, prints returned user metadata, extracts auth cookies from the session, and generates a browser-console JavaScript snippet to inject those cookies into the target site. It also handles a notable secondary condition: if the endpoint returns 403 for non-patient accounts, it checks whether Set-Cookie/auth cookies were still issued before role validation and, if so, prints them for replay toward /wp-admin/. Repository structure is small and focused. Besides the exploit script, there is documentation (README, SECURITY, CONTRIBUTING, LICENSE) and a Docker lab under docker/ that builds a reproducible vulnerable environment. The Docker lab provisions WordPress plus the vulnerable KiviCare plugin, waits for MySQL, installs WordPress, enables permalinks, activates the plugin, and seeds realistic clinic/doctor/patient data via a PHP script. This lab includes known local endpoints and test credentials, making it easy to validate the exploit against localhost:8080. The seed.php file creates WordPress users, populates KiviCare-related metadata, and inserts clinic mappings into KiviCare database tables. Overall, the repository’s purpose is to demonstrate and validate an unauthenticated web authentication bypass and session leakage issue in KiviCare, not merely detect it.

This repository is a real Python proof-of-concept exploit for CVE-2026-2991 affecting the KiviCare Clinic & Patient Management System WordPress plugin up to version 4.1.2. The main exploit file is CVE-2026-2991.py, which uses the requests library to interact with a public KiviCare REST API. It first probes /wp-json/kivicare/v1/ to confirm the plugin namespace is reachable, then submits a crafted POST request to /wp-json/kivicare/v1/auth/patient/social-login with a target email, a claimed social provider (google or apple), and a hardcoded fake token. The exploit relies on the vulnerable endpoint not validating the supplied social token. Primary capability: if the supplied email belongs to a patient account, the script obtains an authenticated session without credentials, prints returned user metadata such as user_id, username, email, roles, nonce, and redirect_url, and extracts WordPress auth cookies from the session. Secondary capability: if the email belongs to a non-patient account such as an administrator, the endpoint may return HTTP 403 after role checking, but the script detects that auth cookies were already issued and prints them for replay. It also generates a browser-console JavaScript snippet that sets document.cookie values and redirects the browser to the returned dashboard URL or /wp-admin/. Repository structure is small and straightforward: one main Python exploit, documentation files, requirements.txt, and a Docker lab under docker/. The Docker lab is not part of the exploit itself but provides a reproducible vulnerable environment. docker-compose.yml launches MySQL and WordPress; Dockerfile installs WordPress, WP-CLI, and the vulnerable KiviCare plugin; entrypoint.sh initializes WordPress files and plugin placement; setup.sh installs WordPress, enables permalinks, activates the plugin, and runs seed.php; seed.php creates a clinic plus seeded admin, doctor, and patient accounts for testing. Overall, the repository’s purpose is to demonstrate and reproduce unauthenticated account takeover of patient users and session leakage for higher-privileged users via the KiviCare social-login REST endpoint.