Authorization Bypass Vulnerability in KiotViet Sync Plugin for WordPress

CVE-2025-12676

What is CVE-2025-12676?

The KiotViet Sync plugin for WordPress contains a vulnerability that allows unauthorized users to bypass authentication when accessing certain functionalities. This issue arises from the use of a hardcoded password in the QueryControllerAdmin::authenticated function. As a result, attackers can exploit this flaw to create and sync products without valid authentication, posing significant risks to WordPress site security. It is crucial for users of versions up to and including 1.8.5 to update their plugins promptly to mitigate this security risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References