CVSS base score
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
What the vulnerability does
The KiotViet Sync plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.8.5 via the register_api_route() function in kiotvietsync/includes/public_actions/WebHookAction.php. This makes it possible for unauthenticated attackers to extract the webhook token value when configured.
Explanation of Vulnerability in Simple Terms
KiotViet Sync versions 1.8.5 and earlier expose sensitive information over the network without requiring authentication. An attacker can read this data directly without needing to log in or interact with a user. The exposure is limited to information disclosure; the attacker cannot modify data or disrupt service.
What an attacker can do
Read sensitive information from the application without logging in.
Potential impact on your site
Sensitive data may be exposed to anyone on the network who knows where to look.
Conditions required to exploit
Network access to the application; no authentication or user interaction required.
Key dates
External resources
