EUVD-2026-58860
GHSA-4mcq-53qw-994j
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Network-reachable API endpoint (AV:N, AC:L) requires a KiviCare-assigned role with settings_view (PR:L); injection yields database read-only access (C:H, I:N, A:N) with no scope change.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare custom role with the 'settings_view' permission (e.g., Doctor or Receptionist), meaning standard WordPress subscribers cannot exploit this without a KiviCare-assigned role.
AnalysisAI
SQL Injection in the KiviCare Clinic & Patient Management System (EHR) WordPress plugin through version 4.5.1 exposes sensitive healthcare database contents to authenticated low-privilege users. The unsanitized 'searchTerm' parameter in SettingsController/ListingData.php (lines 69, 442, 456) is interpolated directly into SQL queries without parameterization, enabling arbitrary data extraction from the underlying WordPress database - including patient records, clinical data, and credential hashes. Exploitation is constrained to KiviCare custom roles bearing the 'settings_view' permission (e.g., Doctor, Receptionist), limiting but not eliminating insider-threat and compromised-account scenarios. No public exploit identified at time of analysis and no CISA KEV listing confirmed.
Technical ContextAI
CWE-89 (SQL Injection) describes the root cause: user-supplied input is concatenated into a SQL query without proper escaping or use of prepared statements with parameterized placeholders. The flaw resides specifically in the WordPress REST API controller SettingsController/ListingData.php within the iqonicdesign KiviCare plugin (CPE: cpe:2.3:a:iqonicdesign:kivicare_-_clinic_&_patient_management_system_(ehr):*:*:*:*:*:*:*:*). The plugin is an Electronic Health Record (EHR) system built on WordPress, meaning the underlying database likely holds Protected Health Information (PHI) - patient demographics, appointment records, and clinical notes - alongside standard WordPress user tables containing password hashes. The affected code paths at lines 69, 442, and 456 of ListingData.php suggest the injection is reachable through a listing/search API endpoint, a common pattern in WordPress REST controllers that build dynamic WHERE clauses from query parameters.
RemediationAI
Update the KiviCare plugin to the version introduced by WordPress plugin changeset 3637394 (referenced at https://plugins.trac.wordpress.org/changeset?reponame=&old=3637394%40kivicare-clinic-management-system&new=3637394%40kivicare-clinic-management-system); however, the exact patched release version number is not explicitly confirmed in the available data - verify the latest release on the WordPress plugin repository and confirm it includes this changeset before deploying. Until an update is applied, apply the principle of least privilege: audit which WordPress users hold KiviCare roles with 'settings_view' permission (Doctor, Receptionist) and remove that permission from accounts where it is not operationally required, as this is the sole exploitation prerequisite. Additionally, deploying a Web Application Firewall rule (e.g., Wordfence's built-in WAF) to block SQL metacharacter patterns in the 'searchTerm' parameter provides a compensating control with low operational impact. Monitor database query logs for anomalous UNION, OR 1=1, or SLEEP() patterns as a detective measure.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today