The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress suffers from a CSRF vulnerability due to inadequate nonce validation in the adminExport() function. This vulnerability allows unauthenticated attackers to perform unauthorized actions by exploiting the trust of an authenticated administrator. Specifically, if the Server command execution setting is enabled, attackers can achieve remote code execution by sending a crafted request that the administrator unknowingly triggers. This affects all plugin versions up to and including 2.7.6 and has a CVSS 3.1 base score of 8.8, indicating high severity.

Successful exploitation can lead to unauthorized modification of plugin settings and remote code execution on the affected server, resulting in full compromise of the WordPress site and potentially the underlying server. The vulnerability requires user interaction (an administrator clicking a malicious link) and the Server command execution setting to be enabled for remote code execution to occur.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should disable the Server command execution setting if enabled and avoid interacting with untrusted links or requests. Monitoring for updates from the vendor or plugin maintainers is recommended to apply any forthcoming patches promptly.