The KiotViet Sync plugin for WordPress contains an authorization bypass vulnerability in all versions up to and including 1.8.5. This flaw arises from the use of a hardcoded password in the authentication function QueryControllerAdmin::authenticated, allowing unauthenticated attackers to create and synchronize products.