The Kiotviet Sync plugin for WordPress contains an unrecommended neutralization of special characters in SQL commands, known as a SQL injection flaw. An attacker who can influence the plugin’s input fields can inject arbitrary SQL statements that may read or modify sensitive database content, potentially exposing customer data or altering store information. The weakness is classified as CWE-89 and can have cascading effects if the SQL injection is exploited to compromise the server’s database.

WordPress sites using the Kiotviet Sync plugin older than version 1.8.4 (the vulnerability affects all releases up to 1.8.3). Any installation that still includes these versions is at risk.

The CVSS score of 8.5 indicates a high severity vulnerability, but the EPSS score of less than 1% suggests that active exploitation is currently unlikely. The vulnerability is not listed in the CISA KEV catalog, so known public exploits are not currently documented. Likely attack vectors involve interacting with the plugin’s public endpoints or administrative interfaces. If an attacker successfully injects SQL, they could read, update, or delete database records, leading to data loss or privilege escalation within the WordPress environment.