CVE-2026-15072

MEDIUM

CVSS v3.1: 6.5 · EPSS: 0.0029 (21.2 percentile)

NetworkNo user interactionSQL InjectionVendor advisory ref

Source data as of:

At a glance

Severity
MEDIUM
CVSS
6.5 v3.1 · NVD
EPSS
0.0029 (21.2 percentile) · FIRST.org
CISA KEV
No
Type
SQL Injection · NVD CWE
Attack conditions (CVSS vector)
NetworkNo user interaction · Source: NVD Vector
Published
2026-07-11 · Modified: 2026-07-11
References
Jump to references (8)

CVSS / EPSS / KEV

CVSS v3.1 6.5 / 10 MEDIUM Source: NVD
EPSS 0.0029 21.2 percentile Source: FIRST.org
CISA KEV No Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to generic SQL Injection via the 'orderby' parameter in all versions up to, and including, 4.5.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with doctor-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. This requires that the attacker hold at minimum a KiviCare Doctor-level account, or a Receptionist or Clinic Admin role that grants the doctor_session_list capability.

Record details

CVE ID
CVE-2026-15072
CVSS (v3.1)
6.5 (MEDIUM)
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Exploitability subscore
2.8
Impact subscore
3.6
EPSS
0.0029 (21.2 percentile) — 2026-07-12
CISA KEV
No
Weakness (CWE)
CWE-89
Affected configurations (CPE)
0
Published
2026-07-11
Modified
2026-07-11
Status
Received

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.

Related records

Other records sharing a factual facet, for cross-reference. A descriptive neighbourhood — ordering does not imply priority and is not a recommendation.

Same weakness type (CWE)

CVE-2026-60090 CRITICAL CVSS 9.8 CVE-2026-15335 HIGH CVSS 7.5 CVE-2026-4661 HIGH CVSS 7.5 CVE-2026-13262 MEDIUM CVSS 6.5

Published the same year

CVE-2026-57827 CRITICAL CVSS 10.0 CVE-2026-61447 CRITICAL CVSS 10.0 CVE-2026-61445 CRITICAL CVSS 9.9 CVE-2026-48939 CRITICAL CVSS 9.8 KEV
← Back to all records