CVE-2026-15453

CVE-2026-15453 is SQL injection in KiviCare's patient search functionality, gated behind a custom 'settings_view' permission. If you're running this plugin, understand what the CVSS 6.5 score obscures: the blast radius is wider than 'authenticated healthcare workers' because KiviCare's custom role assignment lives in the same under-protected codebase. Anyone who can self-assign or escalate to a KiviCare role—potentially starting from WordPress subscriber—can reach the injection point. The deeper pattern here isn't developer negligence—it's structural. WordPress plugins like KiviCare follow a predictable evolutionary path: early versions ship with basic SQL queries and no RBAC. Then compliance requirements (HIPAA in this case) force permission architecture investment. The RBAC gets bolted on top of existing query patterns rather than by refactoring them. Those original queries become 'proven code' that reviewers stop scrutinizing once they're behind permission gates. The 'settings_view' permission persists as an orphaned trust artifact—faithfully enforced, but disconnected from any living architectural rationale. Nobody asks 'why does this need settings_view?' anymore; it just exists. This creates a substitution error: teams invest in sophisticated role-based access controls and treat that investment as a security proxy, not a complement to parameterized queries. The permission check becomes the trust boundary—and the query construction behind it never gets the same scrutiny. For defenders: treat permission-gated endpoints as higher-risk, not lower-risk. Your code review process should explicitly cross-examine diffs that add both permission checks AND database queries together—don't review them in separate passes. Audit whether your RBAC permissions have documented, living rationales, or whether they're historical artifacts enforcing trust decisions made by people who left the project. If you're responsible for KiviCare specifically, treat the CVSS as under-reported and expedite the patch regardless of your organizational triage thresholds—this is an EHR system handling patient data, and the actual blast radius exceeds what the score implies. The fix will be a surgical parameterized query swap. That tells you everything about how this vulnerabilityclass persisted: the RBAC and the SQL safety were never connected in development, not as a deliberate trade-off, but as parallel tracks that never intersected. Expect this pattern to recur in other permission-gated WordPress plugin endpoints.

Reviewed through automated stages and approved by a human before publication.