KiviCare EHR CVE-2026-15453

Exploitation requires an active authenticated session under a KiviCare custom role that carries the 'settings_view' permission - specifically roles such as Doctor or Receptionist as provisioned by the KiviCare plugin. Standard WordPress subscriber, contributor, author, or editor accounts without a KiviCare-assigned role cannot exploit this vulnerability. No user interaction from a victim is required (UI:N), and the attack traverses the network (AV:N) with low complexity once authenticated (AC:L). The primary limiting factor is the mandatory KiviCare role assignment: exploitation is therefore bounded to insiders, compromised staff accounts, or social-engineering scenarios where an attacker obtains clinic employee credentials. Scope is unchanged (S:U), meaning impact is confined to the WordPress/KiviCare database and does not pivot to other systems through this vulnerability alone.

The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) scores 6.5 Medium, which reasonably captures the technical exposure: network-reachable, low complexity, but requiring a low-privilege authenticated session. The critical contextual differentiator is the healthcare data context - successful exploitation against an EHR system likely yields PHI and may trigger HIPAA breach notification obligations, elevating business risk well beyond what CVSS alone suggests. The PR:L requirement is further refined by the description: not just any WordPress subscriber qualifies; the attacker must hold a KiviCare-specific role with 'settings_view' permission (Doctor or Receptionist roles), making this primarily an insider-threat or account-takeover-prerequisite scenario. No EPSS score was provided in the input data, so exploitation probability is unquantified. No CISA KEV listing and no public exploit code confirmed - real-world exploitation priority is moderate, elevated primarily by healthcare sector data sensitivity and the relatively low bar for a clinic employee to be assigned a qualifying role.

A clinic receptionist account (or an attacker who has compromised one) authenticates to the WordPress installation and sends a crafted HTTP request to the KiviCare settings listing API endpoint, injecting a UNION-based or boolean-blind SQL payload into the 'searchTerm' parameter. The server executes the injected query against the WordPress database, returning patient records, appointment histories, or WordPress user password hashes in the API response. No public exploit code is confirmed, but the attack is technically straightforward given the low query complexity (AC:L) and the well-documented nature of CWE-89 exploitation patterns.