An SQL injection vulnerability in the KiviCare WordPress plugin allows authenticated attackers to manipulate database queries and potentially compromise sensitive data.

The plugin suffers from an SQL injection vulnerability (CWE-89) that permits an authenticated user with sufficient privileges to inject malicious SQL commands. This flaw occurs due to improper sanitization of user-supplied input before it is processed by the database.

With a CVSS score of 8.8, this vulnerability poses a significant risk to the confidentiality and integrity of the underlying database. An attacker could potentially extract sensitive patient or user information, modify records, or in some configurations, achieve further unauthorized access to the WordPress environment.

Immediate Action: Update the KiviCare plugin to version 4.5.2 or the latest available version provided by the vendor.

Proactive Monitoring: Review database query logs for anomalous entries or syntax errors that may indicate injection attempts.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules enabled to filter malicious requests directed at the plugin.

Public Exploit Available: Unknown.

Administrators must update the KiviCare plugin immediately to remediate this SQL injection vulnerability. Because a proof-of-concept is documented, the risk of exploitation by malicious actors is elevated.