The KiviCare – Clinic & Patient Management System (EHR) WordPress plugin is vulnerable to SQL Injection via the 'sort[]' parameter in the static_data_list AJAX action. This occurs due to inadequate escaping of user input and improper preparation of SQL queries, enabling authenticated users with doctor or receptionist roles to append malicious SQL commands. The vulnerability affects all versions up to and including 3.6.4. Exploitation can result in unauthorized disclosure of sensitive data from the database. The CVSS 3.1 base score is 6.5, reflecting a medium severity with network attack vector, low attack complexity, and requiring low privileges with no user interaction.

An authenticated attacker with doctor or receptionist-level access can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive information from the backend database. The integrity and availability of the system are not directly impacted according to the CVSS vector, but confidentiality is rated high. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the affected plugin features to trusted users only and monitor for suspicious activity related to the 'sort[]' parameter in AJAX requests. Avoid granting unnecessary privileges to users and consider disabling or removing the plugin if feasible.