SQL Injection Vulnerability in KiviCare Clinic & Patient Management System by WordPress

CVE-2025-1572

What is CVE-2025-1572?

The KiviCare – Clinic & Patient Management System plugin for WordPress is susceptible to an SQL Injection vulnerability through the 'u_id' parameter. This issue arises from inadequate input escaping and insufficient SQL query preparation. Authenticated users with doctor-level access or higher can exploit this vulnerability to inject unauthorized SQL queries into existing ones, potentially leading to unauthorized access to sensitive database information.

References