WordPress Plugin Vulnerabilities

KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint

Description

The plugin does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.

Proof of Concept

Affects Plugins

Plugin icon
kivicare-clinic-management-system
Fixed in 4.5.2

References

CVE
CVE-2026-13613

Classification

Type
SQLI
OWASP top 10
A1: Injection
CWE
CWE-89
CVSS
4.9 (medium)

Miscellaneous

Original Researcher
Mokksh Parekh
Submitter
Mokksh Parekh
Submitter website
https://mokksh.netlify.app
Verified
Yes
WPVDB ID
76b7d66f-6fa3-41e1-9216-ec125e34ade9

Timeline

Publicly Published
2026-08-10 (about 2 days ago)
Added
2026-08-10 (about 1 day ago)
Last Updated
2026-08-10 (about 1 day ago)

Other

Published
Title
Published
2014-09-19
Title
Sendit < 2.1.1 - SQL Injection
Published
2023-11-28
Title
WordPress Brute Force Protection < 2.2.6 - Admin+ SQLi
Published
2026-01-13
Title
Shipping Rates by City for WooCommerce <= 1.0.3 - Authenticated (Shop Manager+) SQL Injection via 'cities' Parameter
Published
2026-04-16
Title
MasterStudy LMS < 3.7.26 - Authenticated (Subscriber+) Time-based Blind SQL Injection via 'order' and 'orderby' Parameters
Published
2025-05-07
Title
Cart tracking for WooCommerce < 1.0.18 - Authenticated (Administrator+) SQL Injection