CVE-2025-1572 is an SQL Injection vulnerability in the KiviCare – Clinic & Patient Management System (EHR) WordPress plugin affecting all versions up to 3.6.7. The issue exists due to improper neutralization of special elements in the 'u_id' parameter, allowing authenticated users with doctor-level privileges to inject additional SQL commands. This vulnerability stems from insufficient escaping of user input and lack of prepared statements in the SQL query construction, enabling unauthorized data extraction from the backend database.

An attacker with authenticated doctor-level access or higher can exploit this vulnerability to extract sensitive information from the database by injecting additional SQL queries. The vulnerability does not affect availability or integrity but compromises confidentiality. There are no reports of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict doctor-level access to trusted users only and monitor for suspicious activity related to SQL query manipulation. Avoid exposing the vulnerable parameter to untrusted input. Follow up with the vendor for updates on patches or official mitigations.