EUVD-2026-43127
GHSA-6745-cr96-xcqp
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable via REST API, low complexity, but PR:L required since exploitation demands a valid KiviCare clinical role; confidentiality-only impact confirmed by ORDER BY injection class.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that the attacker hold at minimum a KiviCare Doctor-level account, or a Receptionist or Clinic Admin role that grants the doctor_session_list capability.
AnalysisAI
SQL injection in KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress (all versions through 4.5.0) allows authenticated attackers with doctor-level or equivalent access to exfiltrate arbitrary database contents via a manipulated 'orderby' parameter. The flaw exists in DoctorSessionController.php and the KCQueryBuilder base class, where ORDER BY clause inputs are neither escaped nor parameterized, enabling appended SQL to traverse the entire WordPress database - including patient records, credentials, and clinical data. No public exploit code or active exploitation has been identified at time of analysis, though Wordfence has disclosed the vulnerability with source code references.
Technical ContextAI
The vulnerability (CWE-89: SQL Injection) resides in the KiviCare WordPress plugin developed by IQonic Design, identified by CPE cpe:2.3:a:iqonicdesign:kivicare_-_clinic_&_patient_management_system_(ehr). The injection point is the 'orderby' HTTP parameter processed by the REST API layer in DoctorSessionController.php (at least lines 87, 1208, and 1282) and routed through KCQueryBuilder.php (at lines 245, 470, and 1283). ORDER BY injection is a class of SQL injection where the attacker injects into a SQL ORDER BY clause; because parameterized queries cannot safely bind column/order values as literals, unsanitized ORDER BY inputs allow UNION-based, subquery, or conditional-timing extraction of arbitrary rows from the database. The plugin manages electronic health records in a clinical setting, making the database contents - patient PII, medical histories, appointment data, and WordPress user credentials - especially sensitive.
RemediationAI
Update the KiviCare plugin to the version released after the upstream SVN changeset 3602561, visible at https://plugins.trac.wordpress.org/changeset?reponame=&old=3602561%40kivicare-clinic-management-system&new=3602561%40kivicare-clinic-management-system - the exact patched version number is not confirmed in available data, so verify the current WordPress plugin repository release. As an immediate compensating control, restrict access to KiviCare's REST API endpoints (specifically those served by DoctorSessionController) to authenticated internal networks using WordPress or web-server-level IP allowlisting, which reduces exposure to external attackers who may have obtained low-privilege credentials via phishing or credential stuffing. Audit KiviCare user accounts to ensure only legitimate clinical staff hold Doctor, Receptionist, or Clinic Admin roles, and remove or deactivate accounts for former employees. Review database access logs for anomalous SELECT queries with UNION or ORDER BY patterns against KiviCare tables. Given the PHI exposure risk, incident response plans and breach notification procedures should be reviewed in parallel with patching.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today