Sensitive Information Exposure in KiotViet Sync Plugin for WordPress

CVE-2025-12677

What is CVE-2025-12677?

The KiotViet Sync plugin for WordPress contains a vulnerability that allows unauthorized users to access sensitive information. Specifically, the issue arises from the register_api_route() function located in the kiotvietsync/includes/public_actions/WebHookAction.php file, which can lead to the exposure of the webhook token value. This vulnerability affects all plugin versions up to and including 1.8.5, making it crucial for site administrators to secure their installations and potentially consider updates or patches to mitigate the risks associated with this vulnerability.

References