Description
The KiotViet Sync plugin for WordPress is vulnerable to authorizarion bypass in all versions up to, and including, 1.8.5. This is due to the plugin using a hardcoded password for authentication in the QueryControllerAdmin::authenticated function. This makes it possible for unauthenticated attackers to create and sync products.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| mykiot | KiotViet Sync | ≤ 1.8.5 | — |