Medium severity · published Jun 27, 2023
CVE-2023-2623
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
6.5
CVSS
0.8%
EPSS
No
On KEV
Description
The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 55% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
KiviCare ·
before 3.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2623
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2623
Exploit
https://wpscan.com/vulnerability/85cc39b1-416f-4d23-84c1-fdcbffb0dda0
More from KiviCare
8.8
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
8.8
CVE-2023-2628
KiviCare Management System < 3.2.1 - Multiple CSRF
7.5
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
6.5
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
6.1
CVE-2023-2624
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting