CVE-2025-62978

MediumCVSS 4.3

Published: 27/10/2025(UTC)Updated: 08/10/2026(UTC)Translated: 08/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.19%

8th percentile - higher than 8% of all known CVEs

Summary

The KiotViet Sync plugin for WordPress has a missing authorization vulnerability, allowing exploitation of incorrectly configured access control security levels. This affects versions from n/a through <= 1.8.5.

Risk Assessment

An attacker can gain unauthorized access to administrative functions, potentially leading to data modification, information theft, or plugin takeover.

Recommendation

Update the KiotViet Sync plugin to a version newer than 1.8.5 that includes the fix. Review permission configuration and restrict access to necessary roles.

Other vulnerabilities in KiotViet Sync

CVE-2025-12677Medium
The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured.

Original NVD description (English source)

Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS