Skip to content
fr Sign in
Not rated

CVE-2023-2628 The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various…

Description

The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)

Affected products and versions

Product Affected versions Fixed in
KiviCare 3.2 earliest → < 3.2.1 3.2.1

References

Timeline

  1. Published
  2. Last modified

Other CVEs of KiviCare

The 10 CVEs of KiviCare →
CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing… 5.3 Medium CVE-2026-19417 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being… 6.5 Medium CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being… 4.3 Medium CVE-2026-13610 The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated… 7.5 High
Track this CVE