CVE-2023-2623: Iqonic Kivicare

Medium severity, CVSS 6.5. EPSS: 0.8% chance of exploitation in the next 30 days.

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users

Affected products

• Iqonic Kivicare: before 3.2.1 (fixed in 3.2.1)

Published 2023-06-27. Last modified 2026-06-17.