CVE-2025-1572
CVSS 3.1 Score 8.8 of 10 (high)
Details
Published Feb 28, 2025
Updated: Mar 6, 2025
CWE ID 89
Summary
CVE-2025-1572 is a vulnerability affecting the KiviCare EHR plugin for WordPress. This issue allows authenticated attackers, with doctor-level access or higher, to conduct SQL Injection attacks via the 'u_id' parameter. The vulnerability is due to insufficient escaping of user-supplied data and inadequate preparation of SQL queries. As a result, attackers can append additional SQL queries to existing ones, potentially extracting sensitive information from the database. Versions up to and including 3.6.7 are impacted.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.