The vulnerability lies in a missing capability check within the saveConfig() function of the KiotViet Sync WordPress plugin. Because the check is omitted, any authenticated user with the Subscriber role or higher can update the plugin’s configuration data. This leaves the site open to unintended changes in synchronization settings, which could expose data or disrupt normal operations, but does not directly allow code execution or broad compromise. The weakness reflects a classic authorization failure (CWE-862).

The issue affects the KiotViet Sync plugin for WordPress versions up to and including 1.8.5. Administrators and any user assigned at least the Subscriber role have the ability to trigger the vulnerable saveConfig() action and modify plugin settings.

The CVSS score of 4.3 indicates moderate severity, and the EPSS score of less than 1 % signals a low probability of exploitation under current conditions. The vulnerability is not listed in CISA’s KEV catalog, suggesting that no documented large‑scale attacks are known. An attacker would need to authenticate to the WordPress installation and possess Subscriber‑level access to exploit the flaw, which limits the attack surface to authenticated users but still allows an insider or compromised account to alter configuration data.