High severity · published Jun 27, 2023
CVE-2023-2628
KiviCare Management System < 3.2.1 - Multiple CSRF
8.8
CVSS
0.4%
EPSS
No
On KEV
Description
The KiviCare WordPress plugin before 3.2.1 does not have CSRF checks (either flawed or missing completely) in various AJAX actions, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks. This includes, but is not limited to: Delete arbitrary appointments/medical records/etc, create/update various users (patients, doctors etc)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 33% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KI
KiviCare ·
before 3.2.1 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2023-2628
CVE.org
https://www.cve.org/CVERecord?id=CVE-2023-2628
Exploit
https://wpscan.com/vulnerability/e0741e2c-c529-4815-8744-16e01cdb0aed
More from KiviCare
8.8
CVE-2026-13613
KiviCare < 4.5.2 - Doctor/Receptionist+ SQL Injection via settings/listing REST Endpoint
7.5
CVE-2026-13610
KiviCare < 4.5.2 - Unauthenticated Privilege Escalation via Registration
6.5
CVE-2026-19417
KiviCare < 4.5.4 - Patient+ Arbitrary Media Attachment Read via IDOR
6.5
CVE-2023-2623
KiviCare Management System < 3.2.1 - Subscriber+ Sensitive Information Disclosure
6.1
CVE-2023-2624
KiviCare Management System < 3.2.1 - Reflected Cross-Site Scripting