What is the CVSS score of CVE-2025-62978?

CVE-2025-62978 has a CVSS 3.1 base score of 4.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.0%.

KiotViet Sync CVE-2025-62978

MEDIUM

Missing Authorization (CWE-862)

2025-10-27 audit@patchstack.com

WordPress Authentication Bypass Wordpress Plugin

4.3

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.3 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

4.3 MEDIUM

Network-reachable by any authenticated user (AV:N/PR:L); integrity-only impact as no data read or availability disruption is described.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 25, 2026 - 12:17 vuln.today

DescriptionCVE.org

Missing Authorization vulnerability in Kiotviet KiotViet Sync kiotvietsync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects KiotViet Sync: from n/a through <= 1.8.5.

AnalysisAI

The KiotViet Sync WordPress plugin through version 1.8.5 exposes restricted administrative functions to low-privileged authenticated users due to missing authorization checks (CWE-862), allowing unauthorized data modification via the plugin's sync operations. The flaw is network-exploitable with low privilege requirements and no user interaction, though impact is limited to integrity (I:L) with no confidentiality or availability consequences. No public exploit code exists and EPSS sits at 0.03% (10th percentile), indicating very low exploitation probability despite the broken access control classification.

Technical ContextAI

CWE-862 (Missing Authorization) occurs when a WordPress plugin registers AJAX handlers, REST API endpoints, or admin-post actions without verifying the calling user's capability level using WordPress nonce and capability checks such as current_user_can(). The KiotViet Sync plugin integrates WordPress e-commerce or product data with the KiotViet POS/retail management platform, a system primarily deployed in the Vietnamese retail market. The access control bypass likely allows subscriber- or contributor-level users to invoke plugin functionality intended for administrators - such as initiating or configuring inventory syncs - without the plugin verifying adequate permissions. The CVSS vector AV:N/PR:L confirms the flaw is reachable over the network by any authenticated WordPress user, not merely local system users.

Affected ProductsAI

The KiotViet Sync WordPress plugin (slug: kiotvietsync) is affected in all versions from an unspecified baseline through and including version 1.8.5. No CPE string was provided in the source data; the affected package can be located in the WordPress Plugin Directory under the slug 'kiotvietsync'. The Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/kiotvietsync/vulnerability/wordpress-kiotviet-sync-plugin-1-8-5-broken-access-control-vulnerability is the primary reference for affected version confirmation.

RemediationAI

Update the KiotViet Sync plugin to a version beyond 1.8.5; the Patchstack advisory at https://patchstack.com/database/Wordpress/Plugin/kiotvietsync/vulnerability/wordpress-kiotviet-sync-plugin-1-8-5-broken-access-control-vulnerability should be consulted to confirm the exact patched release version, as no specific fix version was provided in the available data. If no updated version is yet available, a practical compensating control is to restrict WordPress user registration to trusted personnel only, eliminating the low-privilege attacker prerequisite entirely - this has no side effects on plugin sync functionality. Additionally, a WordPress firewall or WAF plugin (e.g., Wordfence, Patchstack Firewall) with virtual patching rules for this CVE can block exploitation attempts while a vendor patch is awaited. Disabling the plugin entirely is the most conservative option if KiotViet sync functionality is not critical.