Medium severity · published Jun 27, 2023
CVE-2023-2627
KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls
4.3
CVSS
0.2%
EPSS
No
On KEV
Description
The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
None
Integrity
Low
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 16% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
KiviCare ·
before 3.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2627
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2627
Exploit
https://wpscan.com/vulnerability/162d0029-2adc-4925-9985-1d5d672dbe75
More from KiviCare
8.8
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
8.8
CVE-2023-2628
KiviCare Management System < 3.2.1 - Multiple CSRF
7.5
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
6.5
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
6.5
CVE-2023-2623
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure