Executive brief
KiviCare is a WordPress plugin that manages patient records and clinic operations for healthcare providers. The plugin contains a SQL injection vulnerability in its search functionality that allows authenticated users with specific roles (such as doctors or receptionists) to extract sensitive patient data directly from the database. This could result in unauthorized access to confidential medical information, compromising patient privacy and violating healthcare compliance requirements.
Technical details
The vulnerability is a SQL injection flaw in the 'searchTerm' parameter within the SettingsController/ListingData.php component. The vulnerable code fails to properly escape user-supplied input and does not use prepared statements, allowing attackers to inject arbitrary SQL. Exploitation requires authentication and a KiviCare custom role with 'settings_view' permission (e.g., Doctor or Receptionist); standard WordPress subscribers cannot exploit this vulnerability. An authenticated attacker can append SQL queries to extract or modify sensitive information from the database. A patch is available in versions after 4.5.1.
Affected products
- KiviCare Clinic & Patient Management System up to and including 4.5.1
Timeline
- 2026-08-15: disclosed