The EPSS score of 0.00295 for this SQL injection in KiviCare is dangerously misleading, and defenders should not let it anchor their prioritization. The CVSS 8.8 is accurate — SQL injection is a severe primitive — but the healthcare context fundamentally changes the operational risk in ways EPSS cannot capture.
The word 'authenticated' in the CVE description undersells the real attack surface. In KiviCare, the vulnerability lives in the plugin's own role-checking logic for a 'clinic staff' account type. This is not a WordPress administrator account — it's a role provisioned for front desk personnel, appointment handlers, and operational staff. The SQL injection sits inside this gate, meaning you need only a valid clinic staff credential to reach the vulnerable code. In most WordPress healthcare deployments, these accounts are created through standard registration or provisioned by non-technical staff, not locked behind privileged access controls. The bar is much lower than the term 'authenticated' implies in an enterprise context.
Beyond the direct exploit, the blast radius extends into systems that process the data KiviCare stores: insurance processors, lab integrations, pharmacy systems, and referral networks. A single injection doesn't just expose appointment records — it potentially opens lateral pathways into whatever that database feeds. Healthcare data also carries regulatory gravity: HIPAA breach notification obligations run 60 days from discovery, and EU clinics face GDPR implications. The consequence of exploitation is not 'database access' — it's database access plus years of compliance fallout.
The patch exists at version 4.5.2, but the relevant question for defenders is not whether a patch is available, but how many unpatched instances are still running in production, integrated with clinical workflows that get updated on institutional timelines measured in months, not days. The EPSS score models current exploitation probability; it cannot model the population of forgotten deployments that will persist for years. Assume this is actively targeted in any scanning campaign that has KiviCare in its fingerprinting list.