Description

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'searchTerm' parameter in all versions up to, and including, 4.5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with custom-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare custom role with the 'settings_view' permission (e.g., Doctor or Receptionist), meaning standard WordPress subscribers cannot exploit this without a KiviCare-assigned role.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-08-15T04:18:07.300Z",
  "pubdate": "2026-08-15T04:18:07.300Z",
  "executiveSummary": "The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress contains a generic SQL Injection vulnerability affecting all versions up to, and including, 4.5.1. This security flaw stems from insufficient escaping applied to user-supplied input and a lack of proper query preparation within the underlying database interaction logic. Consequently, authenticated threat actors possessing custom-level access and above are capable of injecting malicious SQL statements into existing queries. Successful exploitation of this vulnerability poses severe risk implications, potentially leading to unauthorized extraction of sensitive information residing within the WordPress database. While the attack requires specific privileges, authenticated users assigned a KiviCare custom role possessing the 'settings_view' permission—such as configured Doctors or Receptionists—can successfully execute the payload. Standard unprivileged WordPress subscribers lacking these specific KiviCare roles are unable to perform the attack. Mitigation requires restricting access and properly sanitizing or parameterizing the affected input parameter to prevent arbitrary SQL command execution.",
  "technicalDetails": "The vulnerability resides in the KiviCare – Clinic & Patient Management System (EHR) plugin, specifically impacting the handling of the 'searchTerm' parameter across all versions up to, and including, 4.5.1. The root cause of the flaw is attributable to improper input sanitization and inadequate escaping mechanisms applied to user-supplied data, compounded by the absence of sufficient query parameterization in the existing SQL execution logic. Because the application dynamically concatenates or interpolates the raw 'searchTerm' input directly into database queries without employing prepared statements or parameterized queries, it introduces a classic SQL Injection attack vector. Exploitation requires the attacker to hold authenticated access with specific privilege requirements. Specifically, the attacker must possess a KiviCare custom role equipped with the 'settings_view' permission, such as roles assigned to Doctors or Receptionists. The attack flow commences when the authenticated user submits a crafted HTTP request containing malicious SQL syntax injected into the 'searchTerm' parameter. Because the vulnerable component fails to validate or neutralize the input, the injected SQL commands are appended directly to the pre-existing database query structure executed by the backend database management system. During payload behavior, the injected statements alter the logic of the original query, allowing the attacker to manipulate the execution flow and execute arbitrary database commands. The post-exploitation impact includes the potential unauthorized extraction, exfiltration, or enumeration of sensitive information stored within the underlying database, compromising the confidentiality and integrity of the EHR system."
}