Description
The KiviCare WordPress plugin before 4.5.4 does not verify that the requesting user owns the appointment being modified, allowing authenticated patient-level users to cancel and reschedule other patients' appointments.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | KiviCare | < 4.5.4 | 4.5.4 |
References
- https://wpscan.com/vulnerability/ef2aa44b-3624-4e6d-9b25-e33d4a1a21d2/ exploit vdb-entry technical-description