Description
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | KiviCare | < 4.5.5 | 4.5.5 |
References
- https://wpscan.com/vulnerability/b3f986c8-fa7f-4115-9f33-7e74180256f1/ exploit vdb-entry technical-description