The KiotViet Sync plugin for WordPress stores a hard‑coded password for authentication, allowing an attacker without valid credentials to bypass the plugin’s authorization checks. This vulnerability permits unauthenticated users to create new products and trigger synchronization events, compromising the integrity of the site’s product data and potentially enabling further malicious activity. The weakness corresponds to CWE‑259: Hard‑coded Password.

The vulnerability affects the mykiot KiotViet Sync plugin in all releases up to and including version 1.8.5.

The CVSS score of 5.3 indicates a moderate severity, while the EPSS score of less than 1% suggests a low likelihood of exploitation in the near term. The plugin is not listed in CISA KEV. Based on the description, it is inferred that an attacker can exploit this by sending crafted HTTP requests to the plugin’s QueryControllerAdmin endpoint from any network location, enabling authentication bypass in a remote manner.