CVE-2025-12677: KiotViet Sync Info Disclosure Flaw

CVE-2025-12677 Overview

CVE-2025-12677 affects the KiotViet Sync plugin for WordPress in all versions up to and including 1.8.5. The flaw resides in the register_api_route() function within kiotvietsync/includes/public_actions/WebHookAction.php. Unauthenticated attackers can retrieve the configured webhook token value over the network. The issue is classified as [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor.

Critical Impact
Remote, unauthenticated attackers can extract the webhook token from vulnerable WordPress sites and abuse it to forge or replay webhook traffic against integrations tied to the KiotViet Sync plugin.

Affected Products

KiotViet Sync plugin for WordPress, versions up to and including 1.8.5
WordPress sites with the plugin installed and webhook integration configured
Downstream KiotViet integrations relying on the exposed webhook token

Discovery Timeline

2025-11-05 - CVE-2025-12677 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12677

Vulnerability Analysis

The KiotViet Sync plugin registers a REST API route through the register_api_route() function inside WebHookAction.php. This route returns configuration data that includes the webhook token in its response. The endpoint does not enforce authentication or capability checks before returning the token value. Any anonymous client that can reach the WordPress REST API can retrieve the token when the webhook is configured.

The webhook token functions as a shared secret between KiotViet and the WordPress site. Once disclosed, it no longer authenticates the origin of webhook events. Attackers can craft webhook requests that the plugin will treat as legitimate. The exposure impacts confidentiality only; it does not directly modify site data or degrade availability of the WordPress instance.

Root Cause

The root cause is a missing authorization control on a plugin-registered REST route. The permission_callback for the route allows public access, and the response payload includes the sensitive token rather than restricting it to authenticated administrators. This is a design flaw in the plugin's public action handling for webhook configuration.

Attack Vector

Exploitation requires only network access to the WordPress site. An attacker issues an HTTP request to the plugin's exposed REST endpoint registered by register_api_route(). The server responds with configuration data containing the webhook token. No user interaction, credentials, or elevated privileges are required. Refer to the Wordfence Vulnerability Report for additional technical context.

Detection Methods for CVE-2025-12677

Indicators of Compromise

Unauthenticated HTTP GET requests to KiotViet Sync REST routes under /wp-json/ referencing the plugin namespace
Outbound webhook traffic to KiotViet integrations that does not correlate with legitimate storefront activity
Repeated probing of /wp-json/ endpoints from unfamiliar source addresses

Detection Strategies

Inventory WordPress deployments and identify sites running KiotViet Sync at version 1.8.5 or earlier
Review web server access logs for anonymous requests to plugin REST routes returning non-empty JSON bodies
Correlate WordPress REST API telemetry with authentication logs to flag sensitive responses served without a valid session

Monitoring Recommendations

Enable REST API request logging in WordPress and forward logs to a centralized SIEM or data lake
Alert on responses from plugin routes that include fields resembling tokens, secrets, or API keys
Track version drift on the KiotViet Sync plugin across managed sites and flag hosts that remain on affected versions

How to Mitigate CVE-2025-12677

Immediate Actions Required

Update the KiotViet Sync plugin to a version later than 1.8.5 once the vendor publishes a fix
Rotate the KiotViet webhook token on any site that ran an affected version with a configured webhook
Audit recent webhook activity and reconcile it against expected KiotViet transactions

Patch Information

At the time of publication, the KiotViet Sync plugin page is the authoritative source for release status. Administrators should upgrade to the first vendor release above 1.8.5 that addresses the missing authorization on the webhook REST route. Review the Wordfence advisory for updated fix version details.

Workarounds

Deactivate the KiotViet Sync plugin on sites where the webhook integration is not actively used
Restrict access to the WordPress REST API from untrusted networks using a web application firewall rule
Block anonymous access to plugin-specific REST routes at the reverse proxy until an upstream patch is applied

bash

# Example nginx rule to block unauthenticated access to KiotViet Sync REST routes
location ~* /wp-json/kiotvietsync/ {
    if ($http_authorization = "") {
        return 403;
    }
}