CVE-2026-15073 iqonicdesign CVE debrief

Who should care

WordPress administrators and users with Doctor, Receptionist, or Clinic Admin roles in KiviCare – Clinic & Patient Management System (EHR) plugin should assess and mitigate this SQL Injection vulnerability.

Technical summary

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0. This is due to insufficient escaping on the user-supplied parameter and lack of sufficient preparation on the existing SQL query. Authenticated attackers with Doctor-level access and above can append additional SQL queries into already existing queries, which can be used to extract sensitive information from the database.

Defensive priority

Medium priority given the CVSS score of 6.5 and the requirement for authenticated access with specific role permissions.

Recommended defensive actions

• Inventory and assess installed KiviCare – Clinic & Patient Management System (EHR) plugin versions.
• Restrict access to the vulnerable REST endpoint.
• Implement additional monitoring for suspicious database queries.
• Apply vendor patches or updates when available.
• Enforce least privilege access for WordPress users.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.

Evidence notes

The CVE record was published on 2026-07-11T04:17:21.943Z and has not been modified since then. The vulnerability details are based on the provided CVE and NVD information. Evidence is limited to CVE and NVD data. Defenders should verify KiviCare plugin versions and user roles.

Official resources