A vulnerability classified as problematic has been found in KiviCare Plugin up to 3.2.0 on WordPress (WordPress Plugin). This affects an unknown code block. The manipulation with an unknown input leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality. The summary by CVE is:

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users

The weakness was released 06/27/2023. The advisory is shared at wpscan.com. This vulnerability is uniquely identified as CVE-2023-2623 since 05/10/2023. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 3.2.1 eliminates this vulnerability.

Productinfo

Type

• WordPress Plugin

Name

• KiviCare Plugin

Version

• 3.0
• 3.1
• 3.2

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion