Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2023-2628

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)

Published

2023-06-27T14:15:11.153

Last Modified

2024-11-21T07:58:57.757

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.8 (HIGH)

Weaknesses

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	iqonic	kivicare	< 3.2.1	Yes

References

https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed Exploit, Third Party Advisory ([email protected])
https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed Exploit, Third Party Advisory (af854a3a-2127-422b-91ae-364da2661108)