CVE-2025-12676

23th percentile - higher than 23% of all known CVEs

The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products.

An unauthenticated attacker can create and sync products, potentially injecting false data into the system and disrupting store operations. This may also compromise data integrity and customer trust.

Update the KiotViet Sync plugin to a version newer than 1.8.5 if available, or remove it if not used. Consider implementing additional server-side permission checks.