The vulnerability is a classic SQL injection flaw in the KiviCare WordPress plugin, affecting all releases prior to 4.5.2. When an authenticated user with a clinic staff‑level role submits crafted input to the plugin’s settings/listing REST endpoint, the plugin fails to properly sanitise or escape the parameters before incorporating them into a SQL statement. This allows the attacker to execute arbitrary SQL commands against the WordPress database, potentially extracting sensitive patient records, modifying data, or even installing malware through the database. The impact is therefore the loss of confidentiality, integrity, and availability of the underlying data store.

The KiviCare plugin is the only affected product, with all versions older than 4.5.2 susceptible. The issue exists within the WordPress ecosystem and would affect any site running an affected installation of the plugin.

No public exploit probability is available and the vulnerability is not yet listed in the CISA KEV catalog. The attack requires an authenticated user with clinic staff privileges, but internal personnel are sufficient to exploit the flaw. Because the flaw is a classic SQL injection, anyone with the relevant role could potentially read or manipulate the database directly. The lack of an attacker‑owned payload or documented exploit scripts implies a moderate to high exploitation risk, particularly in environments where role privileges are not tightly controlled.