EUVD-2026-43121
GHSA-hvqv-gc8j-r5g2
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network REST API endpoint (AV:N), no special conditions beyond role possession (AC:L), requires plugin-specific authenticated role (PR:L); read-only ORDER BY injection yields confidentiality impact only (C:H/I:N/A:N).
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Lifecycle Timeline
2DescriptionCVE.org
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare Doctor, Receptionist, or Clinic Admin role at minimum, as the vulnerable REST endpoint is restricted to authenticated users with custom plugin-level access.
AnalysisAI
SQL injection in the KiviCare - Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.0 enables authenticated clinic users to extract arbitrary data from the underlying database via a manipulated 'orderby' REST API parameter. The flaw resides in DoctorSessionController.php (lines 648 and 660) where user-supplied sort values are concatenated into queries without escaping or prepared-statement protections, cascading through KCQueryBuilder.php. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid WordPress account that has been assigned one of three KiviCare plugin-specific roles: Doctor, Receptionist, or Clinic Admin. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 and accurately characterizes the attack: network-reachable, low complexity, low-privilege authenticated, no scope change, confidentiality-only impact. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds a KiviCare Doctor or Receptionist account - whether a malicious insider or an external actor who has compromised a staff credential - authenticates to the WordPress REST API and submits a crafted GET or POST request to the DoctorSessionController endpoint with a payload such as 'orderby=id,(SELECT+1+FROM+(SELECT+SLEEP(5))x)' or a UNION-based extraction string. Because the parameter is appended directly into the ORDER BY clause via KCQueryBuilder, the injected SQL executes against the WordPress database and can return patient records, appointment data, or credential hashes. … |
| Remediation | An upstream fix has been committed to the WordPress plugin repository as changeset 3602561 (https://plugins.trac.wordpress.org/changeset?reponame=&old=3602561%40kivicare-clinic-management-system&new=3602561%40kivicare-clinic-management-system); however, the exact patched release version is not independently confirmed from available data - update to any version released after 4.5.0 once available in the WordPress plugin directory. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today