Authorization Bypass Vulnerability in KiotViet Sync Plugin for WordPress

CVE-2025-12676

What is CVE-2025-12676?

The KiotViet Sync plugin for WordPress contains a vulnerability that allows unauthorized users to bypass authentication when accessing certain functionalities. This issue arises from the use of a hardcoded password in the QueryControllerAdmin::authenticated function. As a result, attackers can exploit this flaw to create and sync products without valid authentication, posing significant risks to WordPress site security. It is crucial for users of versions up to and including 1.8.5 to update their plugins promptly to mitigate this security risk.

References