CVE-2026-15073: KiviCare <= 4.5.0 - Authenticated (Doctor+) SQL Injection via 'orderby' Parameter in DoctorSessionController
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with Doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. Exploitation requires a KiviCare Doctor, Receptionist, or Clinic Admin role at minimum, as the vulnerable REST endpoint is restricted to authenticated users with custom plugin-level access.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
KiviCare – Clinic & Patient Management System (EHR) plugin for WordPressto a version that resolves this vulnerability.Fixed in 4.5.0 - Compensating control
Restrict access to the KiviCare REST endpoint (DoctorSessionController) and limit Doctor-level (or higher) plugin-level access to only trusted users, since exploitation requires an authenticated attacker with DoctorSessionController access.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-15073?
CVE-2026-15073 has a medium severity rating of 6.5.
How do I fix CVE-2026-15073?
To fix CVE-2026-15073, update the KiviCare plugin to version 4.5.1 or later.
What type of vulnerability is CVE-2026-15073?
CVE-2026-15073 is an authenticated SQL Injection vulnerability.
Which software is affected by CVE-2026-15073?
CVE-2026-15073 affects the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress in versions up to 4.5.0.
What is the impact of CVE-2026-15073?
The impact of CVE-2026-15073 is that an attacker could exploit the SQL Injection vulnerability to execute arbitrary SQL queries.