CVE-2026-15073: KiviCare WordPress Plugin SQLi Vulnerability

CVE-2026-15073 Overview

CVE-2026-15073 is a SQL Injection vulnerability in the KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress. The flaw affects all versions up to and including 4.5.0. The vulnerability originates from insufficient escaping of the user-supplied orderby parameter and inadequate preparation of the underlying SQL query. Authenticated users with Doctor, Receptionist, or Clinic Admin roles can append additional SQL clauses to existing queries and extract sensitive data from the WordPress database. The weakness is categorized under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command).

Critical Impact
Authenticated attackers with plugin-level clinical roles can exfiltrate patient records, credentials, and other sensitive data stored in the WordPress database.

Affected Products

KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress, versions up to and including 4.5.0
WordPress sites exposing the vulnerable KiviCare REST endpoint
Deployments granting Doctor, Receptionist, or Clinic Admin roles to non-trusted users

Discovery Timeline

2026-07-11 - CVE-2026-15073 published to NVD
2026-07-15 - Last updated in NVD database

Technical Details for CVE-2026-15073

Vulnerability Analysis

The vulnerability resides in the KiviCare plugin's query builder and doctor session controller. The affected code paths pass the orderby request parameter directly into SQL statements without parameterization or strict allow-list validation. See the plugin source at app/baseClasses/KCQueryBuilder.php line 470 and app/controllers/api/DoctorSessionController.php lines 648 and 660 in the WordPress Plugin Source Code.

Because the vulnerable REST endpoint enforces authentication and a KiviCare-specific role check, exploitation requires valid credentials for a Doctor, Receptionist, or Clinic Admin account. Successful injection returns confidential data through the plugin response, breaking confidentiality without directly modifying stored records.

Root Cause

The root cause is unsafe concatenation of the orderby value into a raw SQL ORDER BY clause. WordPress's $wpdb->prepare() does not handle identifiers, and the plugin does not restrict the parameter to a fixed set of known columns. This design decision allows arbitrary SQL syntax to survive into the executed query.

Attack Vector

An authenticated actor sends a crafted HTTP request to the KiviCare REST route consumed by the Doctor Session controller. The orderby parameter carries a payload that closes the intended clause and appends UNION-based or subquery-based expressions. The server executes the composite query and returns the injected result set as part of the plugin's normal JSON response, enabling exfiltration of arbitrary tables and columns.

Refer to the Wordfence Vulnerability Analysis and the WordPress Change Set Details for the precise vulnerable and patched code.

Detection Methods for CVE-2026-15073

Indicators of Compromise

Requests to KiviCare REST endpoints containing orderby values with SQL keywords such as UNION, SELECT, SLEEP, CASE WHEN, or comment sequences (--, #, /*)
Unexpected long response times or oversized JSON responses from KiviCare API routes, suggesting time-based or UNION-based extraction
Access log entries showing Doctor, Receptionist, or Clinic Admin accounts issuing high volumes of read requests to KiviCare endpoints outside normal working hours

Detection Strategies

Deploy a WordPress-aware Web Application Firewall (WAF) rule that inspects the orderby parameter on /wp-json/kivicare/* routes and blocks non-allow-listed values
Enable MySQL general or slow query logging and alert on queries containing ORDER BY clauses with UNION, subqueries, or conditional expressions
Correlate authentication events with REST activity to detect KiviCare role accounts issuing anomalous query patterns

Monitoring Recommendations

Track outbound response sizes from KiviCare endpoints to surface bulk data extraction
Monitor plugin version drift across WordPress fleets and flag any host still running KiviCare 4.5.0 or earlier
Review WordPress user role assignments monthly and remove Doctor, Receptionist, or Clinic Admin roles from dormant accounts

How to Mitigate CVE-2026-15073

Immediate Actions Required

Update the KiviCare plugin to the version published after 4.5.0 that includes the fix referenced in the WordPress Change Set Details
Audit KiviCare user accounts and revoke Doctor, Receptionist, or Clinic Admin roles that are not strictly required
Rotate WordPress administrator and database credentials if suspicious orderby payloads appear in historical logs

Patch Information

The vendor addressed the flaw by hardening the query builder used by KiviCare. The patch validates the orderby value against an allow-list of column identifiers before it is composed into the SQL statement. Review the diff in the WordPress Change Set Details to confirm your deployment includes the fixed code paths in KCQueryBuilder.php and DoctorSessionController.php.

Workarounds

Restrict access to the KiviCare REST namespace with a WAF rule that rejects requests where orderby does not match a strict identifier pattern such as ^[a-zA-Z0-9_]+$
Temporarily disable the KiviCare plugin on internet-exposed WordPress sites until the patched version is deployed
Enforce IP allow-listing on /wp-json/kivicare/* for clinical staff networks to reduce exposure

bash

# Example ModSecurity rule to block SQL metacharacters in the orderby parameter
SecRule ARGS:orderby "!@rx ^[a-zA-Z0-9_]+$" \
    "id:1015073,\
    phase:2,\
    deny,\
    status:403,\
    log,\
    msg:'CVE-2026-15073 KiviCare orderby SQLi attempt',\
    chain"
    SecRule REQUEST_URI "@beginsWith /wp-json/kivicare/"