The KiviCare – Clinic & Patient Management System for WordPress contains a classic SQL injection flaw triggered by the 'u_id' parameter. The plugin does not escape or prepare the user‑supplied value before incorporating it into a database query, allowing an attacker with doctor‑level or higher privileges to append arbitrary SQL statements. This can lead to the extraction of sensitive records from the database, but the vulnerability does not provide a route to remote code execution. The weakness corresponds to CWE‑89.

Vulnerable versions of the KiviCare – Clinic & Patient Management System (EHR) plugin, issued by iqonicdesign, are all releases up to and including 3.6.7. The flaw exists in the WordPress plugin code and affects any site that has installed the plugin at those version levels.

The CVSS score of 6.5 indicates a moderate level of impact and suggests that the arbitrary code injection could be executed by authenticated users who possess at least doctor‑level access. The EPSS score of less than 1% indicates a low probability of active exploitation in the wild, and the vulnerability is not currently listed in CISA's KEV catalog. An attacker therefore needs an existing valid session for a doctor or higher in order to manipulate the 'u_id' value and retrieve data. The combination of limited exploitation probability and the requirement for privileged access keeps the overall risk moderate, but the data‑leak potential remains significant if a credential compromise occurs.