External risk intelligence

KiotViet Sync WordPress Plugin Arbitrary File Upload Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2025-12674

The vulnerability affects a WordPress plugin, which is typically deployed as a public-facing web application. Since WordPress sites are commonly exposed to the internet to serve content or interact with users, this plugin functionality is inherently reachable from the public internet in most standard deployment scenarios.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

The KiotViet Sync plugin for WordPress has a critical vulnerability that allows unauthenticated attackers to upload arbitrary files to a website's server, potentially leading to remote code execution. This issue affects all versions of the plugin up to and including 1.8.5 and is accessible via the network without any user interaction.

Uploading malicious files to WordPress sites.
Could allow attackers to take control of your website.
Confirm plugin relevance and assess exposure.

Attack Path

How an attacker could exploit the issue

An attacker can upload arbitrary files to a WordPress site's server by exploiting a weakness in the KiotViet Sync plugin. This occurs because the plugin does not properly check the type of files being uploaded. Successful exploitation could allow an attacker to execute their own code on the server.

Unauthenticated attackers can access the vulnerability.
Uploading files via the `create_media()` function.
Potential for remote code execution on the server.

Live Threat

Current exploitation, exposure, and threat context

The KiotViet Sync plugin for WordPress has a vulnerability that allows unauthenticated attackers to upload arbitrary files to the server. When supported by the advisory, this could lead to the execution of malicious code.

Arbitrary files could be uploaded.
Unauthenticated attackers could exploit this.
Remote code execution is possible.

Operational Fix

Recommended remediation, mitigation, and detection steps

Systems hosting the KiotViet Sync plugin for WordPress require immediate attention due to a critical vulnerability enabling arbitrary file uploads and potential remote code execution. The first practical move is to identify all instances of this plugin across your WordPress infrastructure, assess their internet reachability and business criticality, and then assign ownership to the appropriate team for risk-based remediation planning.

WordPress site owners, platform teams.
Confirm plugin presence and internet exposure.
Plan remediation based on asset criticality.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the KiotViet Sync plugin?

KiotViet Sync is an extension for WordPress websites designed to bridge functionality between the WordPress platform and KiotViet services. It manages data transfers, such as media or inventory synchronization, and integrates directly into the site's backend processes to facilitate these automated updates.

What does CWE-434 mean for CVE-2025-12674?

This vulnerability is classified as CWE-434, which refers to Unrestricted Upload of File with Dangerous Type. In simple terms, the plugin fails to verify the extension or content of files uploaded through its create_media() function. Because it lacks these security filters, an attacker can upload malicious scripts disguised as legitimate files, which the server might then execute.

How does an attacker trigger this vulnerability?

An attacker triggers this by interacting with the vulnerable create_media() function. Because the function lacks authentication requirements and file validation, the attacker does not need a valid user account to upload files. Simply sending a crafted request to the site is sufficient; however, interactions that do not utilize this specific media creation pathway will not trigger the bug.

Do I need to worry if my site is not public?

According to Halo Surface Signal, this plugin is typically used in internet-facing web applications. While the vulnerability technically exists on internal servers as well, the risk is highest for sites accessible via the public internet. If your WordPress site is exposed to the web, the barrier for an attacker to reach the vulnerable function is significantly lower than for a strictly isolated internal system.

When should I take action on this CVE?

You should begin immediately by auditing your WordPress environments to identify all instances of the KiotViet Sync plugin. Once located, evaluate which sites are internet-facing or hold sensitive business data. Prioritize these assets for remediation by planning to update or remove the plugin, as unauthenticated file uploads pose a severe risk to your entire server infrastructure.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.