The KiviCare – Clinic & Patient Management System plugin for WordPress contains a generic SQL Injection flaw in the DoctorSessionController REST endpoint, triggered by unsanitized use of the 'orderby' parameter. Because the application concatenates the user-supplied value directly into an existing SQL query without escaping or preparation, an attacker with Doctor or higher level access can append arbitrary SQL statements. This can lead to reading, modifying, or deleting sensitive patient records, appointments, and other confidential data. The weakness maps to CWE-89.

iqonicdesign’s KiviCare – Clinic & Patient Management System plugin for WordPress, versions up to and including 4.5.0, is affected. Any site that has the plugin installed and allows users to log in with Doctor, Receptionist, or Clinic Admin roles has access to the vulnerable REST endpoint and therefore is at risk.

The CVSS score of 6.5 indicates a moderate impact level, while the EPSS score of less than 1% suggests exploitation is currently rare. The vulnerability is not listed in the CISA KEV catalog, but because it requires authenticated access at the Doctor level or higher, any site with such users remains vulnerable to data disclosure or tampering via SQL injection on the REST API.