The KiviCare Clinic & Patient Management System plugin for WordPress contains a critical authentication bypass vulnerability in versions up to 4.1.2. The patientSocialLogin() function fails to verify social provider access tokens, allowing attackers to authenticate as any patient using only an email address and arbitrary token value. This grants unauthorized access to sensitive medical records, appointments, prescriptions, and billing information, constituting a serious PII/PHI breach. The vulnerability also affects authentication cookie handling for non-patient users including administrators.