Arbitrary File Upload Vulnerability in KiotViet Sync Plugin for WordPress

CVE-2025-12674

What is CVE-2025-12674?

The KiotViet Sync plugin for WordPress is susceptible to an arbitrary file upload vulnerability due to inadequate file type validation within the create_media() function. This flaw allows unauthenticated attackers to upload potentially malicious files to the server, which can lead to further exploitation, including remote code execution. All versions up to and including 1.8.5 are affected, making it essential for users to apply security patches and implement best practices for plugin management.

References