CVE-2026-15073

Name of the Vulnerable Software and Affected Versions KiviCare – Clinic & Patient Management System (EHR) versions prior to 4.5.1

Description The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress contains a SQL Injection flaw. This occurs because the application does not sufficiently escape user-supplied input or properly prepare the SQL query. Authenticated users with Doctor, Receptionist, or Clinic Admin roles can exploit this by appending malicious SQL queries to existing ones to extract sensitive data from the database. The issue is located in the orderby parameter within the DoctorSessionController REST endpoint.

Recommendations Update the plugin to a version newer than 4.5.0. As a temporary mitigation, restrict access to the orderby parameter in the DoctorSessionController endpoint.