EUVD-2026-57077
GHSA-6rg5-hf6w-rc4q
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-exploitable over HTTP with low-privilege clinic staff auth required; no user interaction; full CIA impact on the WordPress database; scope unchanged as plugin operates within the same trust boundary.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionCVE.org
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.
Articles & Coverage 1
AnalysisAI
SQL injection in the KiviCare WordPress plugin (all versions before 4.5.2) enables authenticated clinic staff users to execute arbitrary SQL against the underlying WordPress database. Unsanitized user-supplied parameters are passed directly into SQL queries, granting an attacker full read, write, and delete access to database contents including patient records and credentials. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated WordPress session with at minimum a clinic staff-level role granted by the KiviCare plugin - unauthenticated external attackers cannot directly exploit this vulnerability. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 8.8 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) reflects a network-exploitable flaw requiring only low-privilege authentication with full confidentiality, integrity, and availability impact - consistent with classic authenticated SQLi. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds or has obtained a clinic staff-level WordPress account crafts an HTTP request embedding SQL payloads into a KiviCare plugin parameter - for example, a patient search or appointment field. Because the plugin passes this input unsanitized into a SQL query, the attacker can use UNION-based or blind SQL injection techniques to extract the full WordPress database, including wp_users password hashes, patient records, and any stored credentials. … |
| Remediation | Update the KiviCare WordPress plugin to version 4.5.2 or later immediately - this is the vendor-released patch confirmed by the WPScan advisory at https://wpscan.com/vulnerability/76b7d66f-6fa3-41e1-9216-ec125e34ade9/. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: audit all WordPress instances to identify affected KiviCare plugin versions prior to 4.5.2 and document clinic staff system access and database privileges. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The KiviCare WordPress plugin before 2.3.9 does not sanitise and escape some parameters before using them in SQL stateme
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJ
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'vis
Insecure Direct Object Reference (IDOR) in KiviCare WordPress plugin before 4.5.2 allows any authenticated patient-level
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user
The KiviCare WordPress plugin before 3.2.1 does not sanitise and escape a parameter before outputting it back in the pag
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, a
Unauthenticated sensitive data exposure in KiviCare WordPress plugin versions 4.5.1 and below allows remote, unauthentic
A Reflected Cross-Site Scripting (XSS) vulnerability exists in Iqonic Design's KiviCare clinic management system through
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the ‘u_i
Iqonic Design KiviCare clinic management system versions 3.6.16 and earlier contain an authorization bypass vulnerabilit
The KiviCare - Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to SQL Injection via the 'sor
Same weakness CWE-89 – SQL Injection
View allShare
External POC / Exploit Code
Leaving vuln.today