Description

The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-08-12T06:17:31.407Z",
  "pubdate": "2026-08-12T06:17:31.407Z",
  "executiveSummary": "The KiviCare WordPress plugin before version 4.5.2 suffers from a SQL Injection (SQLi) vulnerability, which arises due to the failure to properly sanitise and escape user-supplied parameters before incorporating them directly into database queries.\nThis vulnerability allows authenticated users possessing a clinic staff-level role to execute arbitrary SQL commands against the underlying database.\nThe impact of successful exploitation includes unauthorized database access, potential extraction of sensitive application data, data tampering, and potential compromise of the WordPress database and associated web application environment.\nThe risk implication is rated as significant since internal clinic staff accounts can abuse their existing authenticated privileges to escalate their control over the database.\nExploitation requires the attacker to be authenticated with at least a clinic staff-level role within the WordPress application, meaning the attack surface is restricted to authenticated internal users rather than unauthenticated external visitors.",
  "technicalDetails": "The root cause of the vulnerability lies in the improper sanitisation and escaping of user-supplied parameters within the KiviCare WordPress plugin prior to version 4.5.2.\nWhen specific inputs provided by users are processed by the application, they are concatenated or interpolated directly into SQL queries executed by the database abstraction layer without adequate preparation or parameterization.\nThe affected component is the query generation and handling mechanism within the KiviCare plugin that processes requests from users holding a clinic staff-level role.\nAuthentication and privilege requirements dictate that the attacker must successfully authenticate to the WordPress instance with a clinic staff-level role, granting them access to the vulnerable endpoints or functionalities exposed by the plugin.\nNetwork exposure is inherent to the WordPress web application, meaning any interface accessible to authenticated clinic staff can serve as the vector for input submission.\nThe step-by-step attack flow begins with an authenticated user holding a clinic staff role identifying a vulnerable request parameter processed by the plugin's backend logic.\nThe attacker crafts a malicious payload containing SQL commands designed to manipulate the intended query structure, such as introducing SQL UNION operators or conditional statements.\nUpon submitting this payload, the KiviCare plugin passes the unsanitized parameter directly to the database query execution function.\nThe database interprets the modified query string, executing the injected SQL commands alongside or instead of the original application logic.\nPost-exploitation impact includes the retrieval of sensitive information stored in the database, such as patient records, user credentials, and application configuration details, as well as potential modification or deletion of database contents depending on database user privileges."
}