cve/2023/CVE-2023-2623.md

### [CVE-2023-2623](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2623)
![](https://img.shields.io/static/v1?label=Product&message=KiviCare&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%203.2.1%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-200%20Information%20Exposure&color=brighgreen)

### Description

The KiviCare WordPress plugin before 3.2.1 does not restrict the information returned in a response and returns all user data, allowing low privilege users such as subscriber to retrieve sensitive information such as the user email and hashed password of other users

### POC

#### Reference
- https://wpscan.com/vulnerability/85cc39b1-416f-4d23-84c1-fdcbffb0dda0

#### Github
No PoCs found on GitHub currently.