CVE-2025-12675 is a missing authorization vulnerability (CWE-862) in the KiotViet Sync WordPress plugin. The saveConfig() function lacks a capability check, enabling authenticated users with low-level privileges (Subscriber and above) to update plugin configuration settings. This vulnerability affects all versions up to and including 1.8.5. The CVSS 3.1 base score is 4.3, reflecting a network attack vector, low attack complexity, requiring privileges, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker with Subscriber-level access or higher can modify the plugin's configuration, potentially altering plugin behavior or settings. There is no direct confidentiality or availability impact reported. The integrity of the plugin's configuration data is at risk, which may affect the plugin's operation or security posture.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Subscriber-level access to trusted users only and monitor for unauthorized configuration changes. Avoid granting unnecessary privileges to low-level authenticated users.