KiotViet Sync, CVE-2025-12676

CVE, Research URL: CVE-2025-12676
Home page URL: Security reports for KiotViet Sync
Application: KiotViet Sync
Published on: Nov 05, 2025
Research Description: The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products.
Affected versions: max 1.8.5.
Status: vulnerable