CVE-2023-2627: KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-27 · updated 2026-06-17

Description

The KiviCare WordPress plugin before 3.2.1 does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings

Affected products

iqonicdesign KiviCare – Clinic & Patient Management System (EHR): before 3.2.1 — fixed in 3.2.1

How to fix

Upgrade to a fixed version: iqonicdesign KiviCare – Clinic & Patient Management System (EHR) 3.2.1. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2023-2627 or the next vulnerability affects your stack