CVE-2023-2627: KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability CVE-2023-2627?
The vulnerability CVE-2023-2627 is a lack of proper CSRF and authorization checks in the KiviCare WordPress plugin before version 3.2.1.
How does the vulnerability CVE-2023-2627 affect KiviCare WordPress plugin?
The vulnerability allows authenticated users, such as subscribers, to perform actions they are not authorized to do, such as adding arbitrary Clinic Admin/Doctors and updating plugin's settings.
What is the severity of vulnerability CVE-2023-2627?
The severity of vulnerability CVE-2023-2627 is medium with a CVSS score of 4.3.
How can I fix vulnerability CVE-2023-2627 in KiviCare WordPress plugin?
To fix vulnerability CVE-2023-2627, update the KiviCare WordPress plugin to version 3.2.1 or later.
What are the potential attacks resulting from vulnerability CVE-2023-2627?
The potential attacks resulting from vulnerability CVE-2023-2627 include but are not limited to adding arbitrary Clinic Admin/Doctors and updating plugin's settings.