CVE-2025-12677
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk18th percentile - higher than 18% of all known CVEs
Summary
The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured.
Risk Assessment
An unauthenticated attacker could obtain the webhook token, potentially leading to unauthorized access to integrations. This may compromise data security.
Recommendation
Update the KiotViet Sync plugin to a version above 1.8.5. If possible, rotate the webhook token and monitor for unauthorized use.
Other vulnerabilities in KiotViet Sync
Original NVD description (English source)
The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS