Introduction
Attackers can gain remote code execution on WordPress sites running the KiotViet Sync plugin by uploading a malicious file, and they don't need to authenticate to do it. The affected sites are e-commerce stores that rely on KiotViet POS and WooCommerce integration, so both the integrity of the site and its customer data are at risk.
KiotViet Sync is a WordPress plugin used mostly by small- to mid-sized businesses in Southeast Asia. It synchronizes inventory, orders, and product data between KiotViet POS systems and WooCommerce. The plugin has around 600 active installations. That is a niche audience, but for its users the plugin does a critical job.
Technical information
CVE-2025-12674 is a critical vulnerability caused by missing file-type validation in the create_media() function of the KiotViet Sync plugin. All versions up to and including 1.8.5 are affected (Wordfence).
The plugin does not check the type or contents of uploaded files, so an unauthenticated attacker can upload arbitrary files to the server. To exploit it, the attacker sends a crafted HTTP POST request to the vulnerable endpoint with a PHP script or other executable file attached. The plugin saves that file to a web-accessible directory (such as wp-content/uploads). From there the attacker can access and execute the file, which gives them remote code execution.
Common exploitation techniques include:
- Using double extensions (e.g.,
shell.php.jpg) to bypass naive extension checks - Spoofing the
Content-Typeheader to evade superficial MIME checks
The vulnerability is classified as CWE-434: Unrestricted Upload of File with Dangerous Type.
Affected systems and versions
- Product: KiotViet Sync WordPress plugin
- Affected versions: All versions up to and including 1.8.5
- Vulnerable configuration: Any WordPress site with the plugin enabled and accessible
Vendor security history
KiotViet Sync has a history of other security issues:
- CVE-2025-32573: SQL injection vulnerability in versions up to 1.8.4
- Broken access control and webhook key exposure in recent versions
- Hard-coded passwords and insufficient input validation, which have also been reported
Based on available public sources, the vendor has not shown prompt or transparent communication about security incidents, and its patch response times have been slow.
