Aller au contenu
en Se connecter
Non notée

CVE-2023-2627 The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions,…

Description

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings

Produits et versions touchés

Produit Versions touchées Corrigé en
KiviCare 3.2 premières → < 3.2.1 3.2.1

Références

Chronologie

  1. Publiée
  2. Dernière modification

Autres CVE de KiviCare

Les 10 CVE de KiviCare →
CVE-2026-13611 The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing… 5.3 Moyenne CVE-2026-19417 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being… 6.5 Moyenne CVE-2026-19416 The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being… 4.3 Moyenne CVE-2026-13610 The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated… 7.5 Élevée
Suivre cette CVE