CVE-2023-2628: 
WordPress vulnerability analysis and mitigation

CVE-2023-2628 affects the KiviCare WordPress plugin versions before 3.2.1. The vulnerability was discovered by Erwan LR and publicly disclosed on June 5, 2023. The plugin contains multiple Cross-Site Request Forgery (CSRF) vulnerabilities in various AJAX actions due to missing or flawed CSRF checks (WPScan Advisory).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The issue is classified as CWE-352 (Cross-Site Request Forgery). The vulnerability exists in various AJAX actions that lack proper CSRF protection mechanisms (NVD, WPScan Advisory).

The vulnerability allows attackers to make logged-in users perform unwanted actions through CSRF attacks. These actions include deleting arbitrary appointments and medical records, as well as creating and updating various user types such as patients and doctors (WPScan Advisory).

The vulnerability has been patched in version 3.2.1 of the KiviCare WordPress plugin. Users are advised to update to this version or later to protect against potential CSRF attacks (WPScan Advisory).