CVE-2025-12676: KiotViet Sync Auth Bypass Vulnerability

CVE-2025-12676 Overview

CVE-2025-12676 is an authorization bypass vulnerability in the KiotViet Sync plugin for WordPress. The flaw affects all versions up to and including 1.8.5. The root cause is a hardcoded password used for authentication inside the QueryControllerAdmin::authenticated function. Unauthenticated remote attackers can exploit this weakness to create and synchronize products in the target WordPress site. The issue is tracked under [CWE-259: Use of Hard-coded Password].

Critical Impact
Unauthenticated attackers can bypass authentication and manipulate product data by supplying the hardcoded credential embedded in the plugin code.

Affected Products

KiotViet Sync plugin for WordPress (all versions ≤ 1.8.5)
Deployments exposing the QueryControllerAdmin endpoint
WordPress sites integrating KiotViet product synchronization

Discovery Timeline

2025-11-05 - CVE-2025-12676 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12676

Vulnerability Analysis

The KiotViet Sync plugin exposes an administrative controller, QueryControllerAdmin, that gates privileged operations behind an authenticated method. Instead of validating a WordPress user session or a per-site secret, this method compares the incoming request value against a static password compiled into the plugin source. Because the credential ships with every installation, any actor who inspects the plugin files or reverse-engineers a public copy can recover it and reuse it against any WordPress site running the plugin.

Successful exploitation permits attackers to invoke synchronization endpoints and create product entries without holding a valid WordPress account. The scope is limited to integrity of the plugin's product data, which aligns with the low integrity impact reflected in the CVSS vector.

Root Cause

The underlying defect is the use of a hardcoded password inside QueryControllerAdmin::authenticated. Authentication logic that relies on static, shipped-with-source credentials cannot be considered a security boundary. The credential is identical across every install, cannot be rotated by administrators, and is retrievable by anyone with access to the plugin package on the WordPress plugin directory.

Attack Vector

Exploitation occurs over the network with no authentication or user interaction. An attacker sends a crafted HTTP request to the plugin's admin controller endpoint, includes the known hardcoded password value, and invokes the product creation or synchronization routine. Because the endpoint accepts requests without a valid WordPress nonce or capability check, the attacker's request is processed as if it originated from a trusted synchronization job.

No verified public exploit code is available at this time. Technical detail is described in the Wordfence Vulnerability Report.

Detection Methods for CVE-2025-12676

Indicators of Compromise

Unexpected new products or SKUs appearing in the WordPress store that were not created by staff
HTTP POST requests to KiotViet Sync admin endpoints originating from unauthenticated sessions or unknown IP addresses
Repeated requests to QueryControllerAdmin routes with identical authentication parameters across distinct source IPs

Detection Strategies

Audit WordPress request logs for calls to plugin admin routes that lack an associated authenticated user cookie or nonce
Compare product creation timestamps against known synchronization windows to identify out-of-band writes
Review plugin activity logs for product creation events attributed to system or anonymous contexts

Monitoring Recommendations

Enable HTTP access logging on the WordPress host and forward events to a centralized log store
Alert on any 200-response POST to KiotViet Sync endpoints from external IP addresses outside the KiotViet integration range
Track file integrity of the kiotvietsync plugin directory to detect tampering or backdoored versions

How to Mitigate CVE-2025-12676

Immediate Actions Required

Deactivate the KiotViet Sync plugin on any site running version 1.8.5 or earlier until a patched release is verified
Restrict access to wp-admin and plugin admin endpoints using IP allowlisting at the web server or WAF layer
Review the WordPress product catalog for unauthorized entries created since the plugin was installed

Patch Information

No vendor-supplied patch is referenced in the current NVD entry. Site owners should monitor the KiotViet Sync plugin page on WordPress.org for an updated release beyond version 1.8.5 and apply it immediately when available.

Workarounds

Remove the plugin entirely if KiotViet synchronization is not actively required
Block external HTTP access to the plugin's admin controller routes via web server rules or a WAF
Rotate any WordPress administrator credentials and API keys used alongside the affected installation

bash

# Example: block external access to the KiotViet Sync admin route in nginx
location ~* /wp-content/plugins/kiotvietsync/ {
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;
}