The KiviCare plugin for WordPress suffers from an SQL Injection vulnerability (CWE-89) in the 'orderby' parameter in all versions up to 4.5.0. The issue arises from insufficient escaping of user-supplied input and lack of proper query preparation, enabling authenticated users with doctor-level or higher privileges to append malicious SQL commands. This can be exploited to extract sensitive information from the database. The vulnerability requires at least a KiviCare Doctor-level account or equivalent roles with the doctor_session_list capability. No known exploits are reported in the wild, and no official remediation or patch has been disclosed as of the publication date.

An attacker with authenticated access at the doctor level or higher can exploit this vulnerability to perform SQL Injection attacks, potentially extracting sensitive patient or clinic data from the database. The vulnerability does not affect confidentiality, integrity, or availability beyond data disclosure. The attack requires low complexity and no user interaction beyond authentication. The CVSS score of 6.5 reflects a medium severity impact focused on confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to accounts with doctor-level or higher privileges and monitor for suspicious activity related to SQL query manipulation. Avoid using affected versions in production environments if possible.