KiviCare CVE-2026-13613

Exploitation requires an authenticated WordPress session with at minimum a clinic staff-level role granted by the KiviCare plugin - unauthenticated external attackers cannot directly exploit this vulnerability. The attacker must interact with the specific KiviCare plugin endpoint(s) where unsanitized parameters are passed to SQL queries; no additional non-default configuration beyond having the KiviCare plugin installed and active is required. Limiting factors: the clinic staff role requirement (PR:L) means mass unauthenticated scanning cannot directly exploit this; sites that have granted no external users clinic staff privileges, or that restrict the WordPress admin and login interface to trusted networks, have substantially reduced exposure. Insider threat and credential-compromise scenarios (phishing, brute force, password reuse) are the realistic prerequisite attack paths.

The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring only low-privilege authentication with full confidentiality, integrity, and availability impact - consistent with classic authenticated SQLi. The 17% EPSS score is notably elevated for a WordPress plugin CVE, placing it in the upper tier of exploitation likelihood and suggesting meaningful automated or opportunistic targeting potential. A publicly available POC (reported via WPScan exploit reference) further compresses the time-to-exploit window. The critical limiting factor is the requirement for a clinic staff-level WordPress account: this blocks fully unauthenticated mass exploitation but does not eliminate risk from insider threats, phished credentials, or brute-forced accounts. No CISA KEV listing is present, so active exploitation in the wild is not confirmed - but the POC and EPSS signal together suggest this should be treated as actively targeted imminently if not already.

An attacker who holds or has obtained a clinic staff-level WordPress account crafts an HTTP request embedding SQL payloads into a KiviCare plugin parameter - for example, a patient search or appointment field. Because the plugin passes this input unsanitized into a SQL query, the attacker can use UNION-based or blind SQL injection techniques to extract the full WordPress database, including wp_users password hashes, patient records, and any stored credentials. A publicly available POC from WPScan lowers the skill bar significantly, making scripted exploitation feasible for low-sophistication threat actors.