The vulnerability in KiviCare – Clinic & Patient Management System manifests as a generic SQL Injection flaw triggered by the 'searchTerm' parameter in the API that is not properly escaped or prepared. The weakness, classified under CWE-89, permits an authenticated user with a KiviCare custom role possessing the 'settings_view' permission, such as Doctor or Receptionist, to append arbitrary SQL to existing queries. This can be leveraged to exfiltrate confidential data from the database, thereby compromising patient privacy and the system’s integrity. The plugin’s design requires an authenticated session, meaning the attacker must first gain legitimate access to the WordPress site and possess an elevated role before issuing the injected query.

IQonicDesign’s KiviCare – Clinic & Patient Management System for WordPress, versions 4.5.1 and earlier are affected. The vulnerability resides in all releases up to and including 4.5.1; no specific sub-version granularity is enumerated beyond the Major. Users deploying any of these releases without applying the current fix or patch are vulnerable.

The CVSS score of 6.5 indicates a medium‑severity risk. The EPSS score is not available, so precise exploitation likelihood cannot be quantified, but the lack of a KEV listing suggests no widespread active exploitation is documented. Attackers must first authenticate with a KiviCare role that has 'settings_view' permission, implying that the vector is internal authenticated. Once authenticated, the attacker can exploit the flaw to retrieve arbitrary database information, which could lead to a breach of PHI and other sensitive records.