CVE-2024-11729 is an SQL Injection vulnerability in the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin. It arises from improper neutralization of special elements in the 'service_list[0][service_id]' parameter used in the get_widget_payment_options AJAX action. The plugin fails to properly escape user input and does not use prepared statements, allowing authenticated users with Custom-level access or above to inject additional SQL commands. This can lead to unauthorized extraction of sensitive information from the backend database. The vulnerability affects all versions up to 3.6.4. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges. No patch or official fix has been documented yet.

An authenticated attacker with at least Custom-level privileges can exploit this vulnerability to perform SQL Injection attacks, enabling unauthorized reading of sensitive database information. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. There are no known exploits in the wild currently. The medium severity score reflects the requirement for authenticated access and the potential impact on data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to users with Custom-level privileges or higher and monitor for suspicious activity related to the affected AJAX action. Avoid exposing the vulnerable parameter to untrusted users. Follow vendor updates closely for an official patch or mitigation instructions.