KiviCare EHR CVE-2026-15073

Exploitation requires a valid WordPress account that has been assigned one of three KiviCare plugin-specific roles: Doctor, Receptionist, or Clinic Admin. Standard WordPress roles (subscriber, contributor, author, editor) do NOT satisfy this condition - the REST endpoint enforces KiviCare's own capability checks. The vulnerable parameter is 'orderby' on a DoctorSessionController REST API endpoint, meaning the WordPress installation must have the KiviCare plugin installed and active, and the target site must expose the WP REST API (enabled by default). What limits exploitation: (1) the attacker must possess a KiviCare-role credential, limiting meaningful risk to insider threats or credential-compromise scenarios; (2) impact is read-only (I:N/A:N), so the attacker cannot modify or destroy data through this vector; (3) the injection class is ORDER BY, which typically prevents stacked queries and limits attack technique to UNION-based or time-based blind extraction depending on database configuration.

The official CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 and accurately characterizes the attack: network-reachable, low complexity, low-privilege authenticated, no scope change, confidentiality-only impact. The PR:L designation is the most important limiting signal - exploitation is gated behind a KiviCare-specific role that would only be assigned to clinic staff, not arbitrary WordPress users. This substantially reduces the effective attack surface compared to a PR:N flaw. No KEV listing exists, and no POC is confirmed from available data, making this a low-urgency but real confidentiality risk for organizations running this plugin with multiple staff accounts. The S:U scoping confirms database impact stays within the WordPress installation's database schema. No EPSS probability was provided in the source data, so exploitation likelihood cannot be quantified beyond the structural signals above. The absence of integrity and availability impact (I:N/A:N) is consistent with a read-only ORDER BY injection that cannot write data.

An attacker who holds a KiviCare Doctor or Receptionist account - whether a malicious insider or an external actor who has compromised a staff credential - authenticates to the WordPress REST API and submits a crafted GET or POST request to the DoctorSessionController endpoint with a payload such as 'orderby=id,(SELECT+1+FROM+(SELECT+SLEEP(5))x)' or a UNION-based extraction string. Because the parameter is appended directly into the ORDER BY clause via KCQueryBuilder, the injected SQL executes against the WordPress database and can return patient records, appointment data, or credential hashes. No public proof-of-concept has been confirmed, but the vulnerability class is well-understood and the code path is publicly visible in the plugin repository.