CVE-2025-12676 is a medium severity vulnerability in the KiotViet Sync WordPress plugin caused by the use of a hardcoded password in the QueryControllerAdmin::authenticated function. This flaw enables unauthenticated attackers to bypass authorization controls and perform product creation and synchronization actions. The vulnerability affects all versions up to and including 1.8.5. The CVSS vector indicates network attack vector, low attack complexity, no privileges required, no user interaction, unchanged scope, no confidentiality or availability impact, and limited integrity impact.

An attacker without authentication can bypass authorization mechanisms due to the hardcoded password, allowing them to create and synchronize products within the affected plugin. This could lead to unauthorized data manipulation or insertion of malicious product data. There is no reported impact on confidentiality or availability, and no known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling the KiotViet Sync plugin or restricting access to the affected functionality to trusted users only. Monitor vendor communications for updates regarding patches or official mitigations.