Video Merchant CVE-2025-14390

Exploitation requires that the site runs the Video Merchant plugin at version 5.0.4 or earlier, where the video_merchant_add_video_file() function lacks correct nonce validation. The attacker does not need credentials (PR:N), but exploitation is strictly gated on tricking an authenticated site administrator into performing an action such as clicking an attacker-supplied link while logged in (UI:R) - without this victim interaction the forged request cannot be submitted. The achievable impact (arbitrary file upload leading to RCE) further depends on the server executing uploaded file types (e.g., PHP) from the upload location. The admin-interaction requirement and the plugin's limited deployment are the primary factors limiting real-world exploitation.

This is a genuinely serious flaw (CVSS 8.8) but its real-world risk is materially lower than the base score suggests because exploitation is not fully self-contained. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H shows network reach, low complexity, and no attacker authentication (PR:N), but crucially requires user interaction (UI:R) - a logged-in site administrator must be tricked into triggering the forged request, which is the defining characteristic of CSRF (CWE-434 file upload chained via missing nonce validation). The EPSS score of 0.45% (37th percentile) is low, indicating no significant observed or predicted mass-exploitation activity. There is NO CISA KEV listing and NO public exploit code flagged in the provided data, so per precision rules this is 'no public exploit identified at time of analysis.' The signals are internally consistent rather than conflicting: a high technical-impact bug (full C/I/A compromise via RCE) gated behind a social-engineering prerequisite and a niche plugin footprint. Conclusion: this is a real patch-worthy issue for sites running Video Merchant, but it is NOT a drop-everything emergency on the level of an unauthenticated, no-interaction RCE - the admin-interaction requirement and low EPSS argue for prioritized-but-not-critical scheduling.

An attacker crafts a malicious web page or email link containing a forged request targeting the vulnerable video_merchant_add_video_file() endpoint and lures a logged-in WordPress administrator into clicking it. Because nonce validation is missing, the victim's browser submits the forged file upload, placing an attacker-controlled executable file (e.g., a PHP webshell) on the server, which the attacker then accesses to achieve remote code execution. No public exploit code is identified at time of analysis, so a working PoC would need to be developed.