KiotViet Sync Missing Authorization Vulnerability in WordPress Plugin
Vulnerability
A vulnerability exists in the KiotViet Sync plugin for WordPress, all versions through 1.8.5, allowing unauthorized data modification. This issue arises from a missing capability check in the saveConfig() function, enabling authenticated attackers with Subscriber-level access or higher to alter the plugin's configuration.
Impact
Exploitation of this vulnerability could lead to unauthorized changes in the plugin's configuration, potentially allowing for further malicious actions or disruptions.
Added: Nov 5, 2025, 8:17 AM
Updated: Nov 5, 2025, 8:17 AM
Vulnerability Rating
Custom Algorithm
spread
0.0impact
2.5exploitability
5.2remediation
0.0relevance
0.9threat
0.0urgency
2.9incentive
1.7Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.