CVE-2023-2623

published 2023-06-27

CVE-2023-2623: The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users…

Priority P3 35 medium 6.5 CVSS 3.1

AV N AC L PR L UI N S U C H I N A N

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users

Affected

1 ranges

Vendor	Product	Version range	Fixed in
iqonic	kivicare	< 3.2.1	3.2.1

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-200