KiviCare EHR EUVD-2026-43127

Exploitation requires the attacker to hold a valid KiviCare application-level account at minimum Doctor role, OR a Receptionist or Clinic Admin role that grants the doctor_session_list capability - standard WordPress subscriber or editor roles are not sufficient. The attacker must be able to send authenticated HTTP requests to the KiviCare REST API endpoints handled by DoctorSessionController.php. The 'orderby' parameter must be accepted and processed by the vulnerable KCQueryBuilder path (at lines 245, 470, or 1283). No non-default configuration is required beyond having the plugin installed and active. What limits exploitation: the requirement for a legitimate KiviCare clinical account prevents unauthenticated mass exploitation; impact is read-only (no database writes confirmed); and the plugin's niche healthcare deployment base limits the pool of potential attackers with relevant credentials.

CVSS 3.1 rates this 6.5 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, reflecting network-reachable exploitation with low complexity but requiring a low-privilege authenticated account. The PR:L requirement is a meaningful barrier here: an attacker must hold a KiviCare Doctor, Receptionist, or Clinic Admin account - not merely a WordPress subscriber account - reducing the unauthenticated attack surface significantly. No EPSS data was provided; no CISA KEV listing exists; no public POC has been identified. Despite the moderate CVSS score, the C:H rating is operationally critical for healthcare deployments because the exfiltrated data includes protected health information (PHI) subject to HIPAA and equivalent regulations, meaning a successful attack carries regulatory and legal consequences beyond technical impact alone. The I:N and A:N ratings confirm this is read-only extraction; no data modification or service disruption has been demonstrated. Real-world priority should be elevated for healthcare organizations running this plugin, but the authentication prerequisite limits opportunistic mass exploitation.

An attacker who has obtained or created a KiviCare Doctor-level account - whether through credential theft, insider access, or social engineering - sends a crafted API request to a DoctorSessionController endpoint, injecting a SQL subquery into the 'orderby' parameter. The unsanitized parameter is passed directly into the ORDER BY clause of an existing query via KCQueryBuilder, allowing the attacker to use UNION-based extraction or conditional expressions to dump arbitrary tables including WordPress user password hashes, patient records, and appointment histories. No public POC has been identified, but the source code references published by Wordfence expose the exact vulnerable lines, significantly lowering the bar for exploit development.