CVE-2026-15072: KiviCare WordPress Plugin SQLi Vulnerability

CVE-2026-15072 Overview

CVE-2026-15072 is an authenticated SQL injection vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress. The flaw affects all versions up to and including 4.5.0. It stems from insufficient escaping of the user-supplied orderby parameter and lack of proper preparation on the underlying SQL query. Attackers holding a KiviCare Doctor-level account, or a Receptionist or Clinic Admin role with the doctor_session_list capability, can append additional SQL statements to extract sensitive database contents. The vulnerability is tracked under [CWE-89] (SQL Injection).

Critical Impact
Authenticated users with doctor-level access or above can extract sensitive patient, clinical, and credential data from the WordPress database through crafted orderby values.

Affected Products

KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, versions ≤ 4.5.0
KCQueryBuilder.php component (base class query builder)
DoctorSessionController.php API controller

Discovery Timeline

2026-07-11 - CVE-2026-15072 published to NVD
2026-07-13 - Last updated in NVD database

Technical Details for CVE-2026-15072

Vulnerability Analysis

The vulnerability is a generic SQL injection in the KiviCare plugin's query builder logic. The orderby parameter, supplied through requests handled by the doctor session API, is concatenated into a SQL statement without adequate escaping or use of prepared statements. Because the parameter flows into the ORDER BY clause, standard input validation such as esc_sql() or $wpdb->prepare() placeholders were not applied to constrain values to a safe allow-list of column names or sort directions.

Exploitation requires authentication at KiviCare Doctor level or higher, including Receptionist or Clinic Admin roles that grant the doctor_session_list capability. Once authenticated, an attacker crafts orderby values containing subqueries or UNION-based payloads. The appended SQL executes with the WordPress database user's privileges, permitting extraction of records from wp_users, wp_usermeta, and KiviCare's clinical tables containing patient and appointment data.

Root Cause

The root cause is the direct interpolation of the orderby request parameter into SQL statements constructed in KCQueryBuilder.php at lines 245, 470, and 1283, and invoked from DoctorSessionController.php at lines 87, 1208, and 1282. The plugin did not restrict orderby to a fixed allow-list of column identifiers, and it did not bind the value through $wpdb->prepare() placeholders, which do not natively support identifier binding.

Attack Vector

The attack vector is network-based over HTTP(S) to the WordPress REST or admin-ajax endpoints exposed by the KiviCare plugin. An authenticated attacker submits a request to a doctor session listing endpoint with a malicious orderby value. See the Wordfence Vulnerability Advisory and the KCQueryBuilder source at line 1283 for the vulnerable code paths.

Detection Methods for CVE-2026-15072

Indicators of Compromise

HTTP requests to KiviCare doctor session endpoints containing SQL keywords such as UNION, SELECT, SLEEP, INFORMATION_SCHEMA, or comment sequences (--, /*) inside the orderby parameter.
Unexpected database errors in debug.log or MySQL error logs referencing malformed ORDER BY clauses.
Anomalous data egress or bulk response sizes from authenticated Doctor, Receptionist, or Clinic Admin sessions.

Detection Strategies

Inspect WordPress access logs and web application firewall (WAF) telemetry for orderby values that contain non-alphanumeric characters or SQL syntax.
Correlate authenticated KiviCare API calls with sudden spikes in database query duration or row counts.
Monitor for privilege enumeration by low-privileged clinical users targeting wp_users or wp_usermeta tables.

Monitoring Recommendations

Enable WordPress query logging and forward WordPress and MySQL logs to a centralized analytics platform for retrospective search.
Alert on any HTTP parameter named orderby whose value fails a strict ^[a-zA-Z0-9_]+( (ASC|DESC))?$ regex check.
Track account role changes for accounts holding the doctor_session_list capability, as compromise of these roles enables exploitation.

How to Mitigate CVE-2026-15072

Immediate Actions Required

Upgrade the KiviCare – Clinic & Patient Management System (EHR) plugin to a version newer than 4.5.0 that includes changeset 3602561.
Audit KiviCare user accounts and revoke Doctor, Receptionist, and Clinic Admin roles that are no longer required.
Rotate credentials and secrets stored in the WordPress database if exploitation is suspected, including administrator passwords and API keys.

Patch Information

The vendor addressed the issue in the commit referenced by WordPress Kivicare Changeset 3602561. Site owners should update the plugin through the WordPress plugin manager or WP-CLI to the fixed release. Confirm the update by verifying the installed plugin version is greater than 4.5.0.

Workarounds

Deploy a WAF rule that rejects requests to KiviCare endpoints when the orderby parameter contains characters outside a strict identifier allow-list.
Temporarily restrict access to KiviCare API endpoints to trusted IP ranges via web server or reverse proxy rules.
Disable the KiviCare plugin until the patched version is installed if immediate upgrade is not possible.

bash

# Configuration example: WP-CLI upgrade and access restriction
wp plugin update kivicare-clinic-management-system
wp plugin get kivicare-clinic-management-system --field=version

# Nginx example: block suspicious orderby values on KiviCare routes
location ~* /wp-json/kivicare/ {
    if ($arg_orderby ~* "[^A-Za-z0-9_]") { return 403; }
}