PT-2025-45093 · WordPress · Kiotviet Sync

Kenneth Dunn · Published 2025-11-05 · Updated 2025-11-05 · CVE-2025-12675

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions KiotViet Sync plugin for WordPress versions up to and including 1.8.5

Description The KiotViet Sync plugin for WordPress is susceptible to unauthorized data modification. This is due to a missing capability check within the saveConfig() function. Authenticated attackers with Subscriber-level access or higher can update the plugin’s configuration.

Recommendations Update the KiotViet Sync plugin to a version newer than 1.8.5.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-12675

Affected Products

Kiotviet Sync

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-12675 · Security Note
• https://wordpress.org/plugins/kiotvietsync · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/e67c6c3f-0b2a-424f-b8f2-2771449c82b4?source=cve · Note
• https://t.me/CVEtracker/36603 · Telegram Post
• https://t.me/cveNotify/141778 · Telegram Post