Iqonic Design KiviCare translates user input directly into an SQL query without proper escaping, resulting in a SQL Injection flaw (CWE‑89). An attacker who can supply crafted input to the plugin can execute arbitrary SQL statements against the underlying database, potentially reading, modifying, or deleting sensitive data stored in the clinic management system. The vulnerability directly compromises confidentiality, integrity, and possibly availability of the business data managed by the plugin.

The vulnerability affects the Iqonic Design KiviCare plugin (kivicare‑clinic‑management‑system) for WordPress. All releases from the earliest available version up to and including version 3.6.13 are impacted; no later versions are listed as vulnerable.

With a CVSS score of 8.5, this flaw is rated high severity. The EPSS score of less than 1% indicates a low estimated exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation would likely require ability to deliver input to the plugin via its web interface, possibly needing authenticated access to administrative pages, though the exact prerequisites are not detailed in the advisory. If exploited, the attacker could exfiltrate or alter the clinic’s patient and appointment data.