KiviCare Management System < 3.2.1 - Multiple CSRF

Vulnerability

The KiviCare WordPress plugin versions prior to 3.2.1 contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities in various AJAX actions. The plugin either has no CSRF token validation or incomplete validation in these actions, allowing an attacker to forge requests on behalf of an authenticated user [1]. Affected versions are all releases before 3.2.1.

Exploitation

An attacker can craft a malicious link or webpage that, when visited by a logged-in administrator or other privileged user, triggers AJAX requests to the vulnerable plugin endpoints. No authentication or special network position is required beyond luring the victim to the attacker-controlled resource. The user must be logged into a WordPress site with the KiviCare plugin installed and have the necessary roles to perform the targeted actions [1].

Impact

Successful CSRF exploitation enables an attacker to perform unwanted actions on behalf of the victim, including but not limited to: deleting arbitrary appointments or medical records, and creating or updating users (patients, doctors, etc.). This can lead to data loss, unauthorized privilege escalation, or disruption of the medical management system [1].

Mitigation

The vulnerability is fixed in KiviCare version 3.2.1, released on or before June 5, 2023 [1]. Users should update to this version immediately. No other workarounds are documented in the available references. The plugin should be updated from the WordPress plugin repository or vendor site.