KiviCare Management System < 3.2.1 - Multiple CSRF

CVE-2023-2628

What is CVE-2023-2628?

The KiviCare WordPress plugin, prior to version 3.2.1, is susceptible to a serious security issue due to the absence of adequate CSRF checks in its AJAX actions. This oversight permits malicious actors to exploit the vulnerability, enabling them to coerce authenticated users into executing unintended actions. Such unauthorized actions may include the deletion of arbitrary appointments, manipulation of medical records, and the creation or updating of user accounts—affecting both patients and doctors.

References