Non notée
CVE-2023-2628 The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various…
Description
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| KiviCare 3.2 | premières → < 3.2.1 | 3.2.1 |
Références
- wpscan.com wpscan.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de KiviCare
Les 10 CVE de KiviCare →
CVE-2026-13611
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing…
5.3
Moyenne
CVE-2026-19417
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user is entitled to the media file being…
6.5
Moyenne
CVE-2026-19416
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being…
4.3
Moyenne
CVE-2026-13610
The KiviCare WordPress plugin before 4.5.2 does not restrict the roles assignable through its unauthenticated…
7.5
Élevée