CVE-2025-14390 affects the Video Merchant WordPress plugin through a CSRF vulnerability caused by missing or incorrect nonce validation in the video_merchant_add_video_file() function. This flaw permits unauthenticated attackers to upload arbitrary files by leveraging a forged request that requires user interaction from an administrator. The uploaded files can be of dangerous types, enabling remote code execution. The vulnerability is identified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and has a high CVSS score of 8.8, indicating significant confidentiality, integrity, and availability impacts. The affected versions include 5.0.4 and earlier. No patch or remediation details are currently available from the vendor or advisory sources.

Successful exploitation allows unauthenticated attackers to upload arbitrary files via a CSRF attack, potentially leading to remote code execution on the affected WordPress site. This compromises confidentiality, integrity, and availability of the system. The attack requires tricking an administrator into performing an action, but no privileges or authentication are needed by the attacker. The vulnerability poses a high risk to sites using vulnerable versions of the Video Merchant plugin.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should limit exposure by restricting administrative access, avoiding clicking on untrusted links, and monitoring for suspicious file uploads related to the Video Merchant plugin. Do not rely solely on generic security measures; follow vendor updates closely for an official fix.