The KiotViet Sync plugin for WordPress allows unauthenticated users to upload any file because the create_media() function lacks file type validation. An attacker can place malicious code on the server, potentially leading to full remote code execution. The weakness is a classic arbitrary file upload flaw (CWE-434).

All installations of the KiotViet Sync plugin from mykiot up to version 1.8.5 are vulnerable. This includes 1.8.5 and every lower release of the plugin distributed via WordPress.

The CVSS score of 9.8 marks this as critical, and although the EPSS score is currently below 1%, the lack of any mitigation makes exploitation straightforward for anyone who can send an HTTP request to the vulnerable endpoint. The vulnerability is not listed in CISA’s KEV catalog, but its impact is significant due to the potential for remote code execution. Attackers do not need authentication; they can simply send a crafted upload request to the server. Given the high severity and the complete absence of defensive controls, organizations should treat this as an urgent incident.