The KiviCare plugin for WordPress is vulnerable to SQL Injection via the 'searchTerm' parameter due to insufficient escaping and lack of proper query preparation. This allows authenticated users with specific KiviCare roles (custom-level access with 'settings_view' permission) to inject additional SQL commands into existing queries, potentially exposing sensitive database information. The vulnerability affects all versions up to and including 4.5.1. There is no vendor advisory or patch currently available, and no known exploits in the wild have been reported.

An attacker with authenticated access and a KiviCare role that includes 'settings_view' permission can exploit this vulnerability to extract sensitive information from the database. The vulnerability does not allow privilege escalation or denial of service but can lead to unauthorized data disclosure. Standard WordPress users without the required KiviCare role cannot exploit this issue.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to users with KiviCare roles that have 'settings_view' permission and monitor for suspicious activity related to SQL query manipulation. Avoid granting unnecessary permissions to users.