Vulnerability · Published Jun 27, 2023 · Assigned by WPScan
CVE-2023-2628KiviCare Management System < 3.2.1 - Multiple CSRF
High 8.8
In plain English
A high-severity security flaw in KiviCare from Unknown. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS NVD)8.8High
Exploit odds (30 days)0.4%top 66.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Affected products (as reported)
References
- https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed exploit, vdb-entry, technical-description