Is CVE-2026-13613 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-13613 being exploited in the wild.

How severe is CVE-2026-13613?

High severity, with a CVSS score of 8.8, published 12 August 2026.

Which products and versions are affected?

Revamp Studio KiviCare before 4.5.2.

Is there a fix for CVE-2026-13613?

A patch was published on 2026-08-12: Fixed in version 4.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-13613 attacked?

It is attacked over the network.

Am I affected by CVE-2026-13613?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-13613: KiviCare SQL injection in settings/listing endpoint

CVE-2026-13613 · Severity: high · CVSS 8.8 · Published 2026-08-12

KiviCare is a clinic management system WordPress plugin used to manage patient records and clinic operations. A flaw in the plugin allows authenticated clinic staff members (doctors or receptionists) to inject malicious SQL commands through a search field, potentially exposing sensitive data such as patient records or administrator credentials. The vulnerability requires staff-level access but could lead to unauthorized access to confidential health and business information.

Quick answers

Is CVE-2026-13613 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-13613 being exploited in the wild.
How severe is CVE-2026-13613?: High severity, with a CVSS score of 8.8, published 12 August 2026.
Which products and versions are affected?: Revamp Studio KiviCare before 4.5.2.
Is there a fix for CVE-2026-13613?: A patch was published on 2026-08-12: Fixed in version 4.5.2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-13613 attacked?: It is attacked over the network.
Am I affected by CVE-2026-13613?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The plugin fails to properly sanitize and escape the searchTerm parameter before using it in a SQL LIKE query on the /wp-json/kivicare/v1/settings/listing REST endpoint. The parameter is passed through sanitize_text_field and esc_like, but these functions do not strip or escape single quotes, allowing an authenticated attacker to break out of the LIKE literal and inject arbitrary SQL. An attacker with clinic staff-level role (kiviCare_doctor or kiviCare_receptionist) and access to a valid REST nonce can execute time-based SQL injection to extract arbitrary database contents, including administrator credentials. The vulnerability has been patched in version 4.5.2 by properly validating and escaping the searchTerm parameter.

Affected products

Revamp Studio KiviCare before 4.5.2

Timeline

2026-08-10: disclosed
2026-08-12: patched: Fixed in version 4.5.2

References

https://wpscan.com/vulnerability/76b7d66f-6fa3-41e1-9216-ec125e34ade9/

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.