SQL Injection Vulnerability in KiviCare – Clinic & Patient Management System Plugin for WordPress

CVE-2026-15072

What is CVE-2026-15072?

The KiviCare – Clinic & Patient Management System plugin for WordPress has a vulnerability that allows for generic SQL Injection through the 'orderby' parameter. This issue arises from insufficient escaping of user-supplied input and a lack of proper preparation in SQL queries. Authenticated users, such as doctors, receptionists, or clinic admins with specific access levels, can exploit this vulnerability to inject additional SQL commands into existing queries, potentially gaining unauthorized access to sensitive information stored in the database. Addressing this issue promptly is crucial for maintaining the integrity of user data.

References