PT-2025-50316 · WordPress · Video Merchant

Ala Arfaoui · Published 2025-12-10 · Updated 2025-12-15 · CVE-2025-14390

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Video Merchant plugin for WordPress versions 5.0.4 and earlier

Description The Video Merchant plugin for WordPress is susceptible to Cross-Site Request Forgery (CSRF). This is due to inadequate nonce validation within the video merchant add video file() function. Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to remote code execution if they can trick a site administrator into performing an action, such as clicking a malicious link.

Recommendations Update the Video Merchant plugin to a version newer than 5.0.4.

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-14390

Affected Products

Video Merchant

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-14390 · Security Note
• https://t.me/CVEtracker/39352 · Telegram Post
• https://twitter.com/CVEnew/status/1998732737952493817 · Twitter Post
• https://twitter.com/CveFindCom/status/1998704039983268292 · Twitter Post
• https://twitter.com/cracbot/status/2000521280991498459 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1998733252073271523 · Twitter Post
• https://wordfence.com/threat-intel/vulnerabilities/id/7cbe39ae-d10b-432f-afab-682948de2521?source=cve · Note
• https://wordpress.org/plugins/video-merchant · Note