The KiotViet Sync plugin for WordPress contains a flaw that allows an unauthenticated attacker to learn the webhook token. The vulnerability stems from the register_api_route() function in WebHookAction.php, which exposes the token value when it is configured. Because the webhook token grants privileged access to the service, disclosure enables an attacker to perform token‑based operations or abuse the integration.

Vulnerable versions of the KiotViet Sync WordPress plugin (up to and including 1.8.5). The flaw exists in all builds from the earliest release to 1.8.5, regardless of other configuration. The affected product is identified as mykiot:KiotViet Sync.

The CVSS base score is 5.3, classifying the issue as Medium severity. The EPSS score is less than 1%, indicating a low probability of exploitation at this time. The weakness is not listed in CISA KEV. Based on the description, it is inferred that the flaw can be triggered by any web request to the plugin, although the exact request path is not explicitly specified. The vulnerability does not require authentication or elevated privileges. An attacker who discovers the token can then use it to interact with the webhook API and potentially compromise the target site or the backend service.