CVE-2026-13613
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk21th percentile - higher than 21% of all known CVEs
Summary
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query. Authenticated users with a clinic staff-level role can perform SQL injection.
Risk Assessment
Risk of unauthorized database access, including reading, modifying, or deleting data. This can lead to leakage of sensitive medical information and system integrity compromise.
Recommendation
Update the KiviCare plugin to version 4.5.2 or later. Use prepared statements and restrict clinic staff privileges.
Original NVD description (English source)
The KiviCare WordPress plugin before 4.5.2 does not properly sanitise and escape user-supplied parameters before using them in a SQL query, allowing authenticated users with a clinic staff-level role to perform SQL injection.