The Video Merchant WordPress plugin allows unauthenticated attackers to craft forged requests that bypass nonce validation in the video_merchant_add_video_file() function, permitting them to upload arbitrary files. When such files are executed, an attacker can achieve remote code execution. The weakness is a file‑upload flaw (CWE‑434). This grants full compromise of affected sites if the uploaded content can be executed by the server.

All installations of the Video Merchant plugin for WordPress with version 5.0.4 or earlier are vulnerable. The flaw exists in the plugin code that handles file uploading, and no fixed version is listed in the supplied data.

The CVSS score of 8.8 signals a high‑severity flaw. The EPSS value of less than 1% indicates that real‑world exploitation is currently rare, likely because the attack requires a user to unknowingly click a malicious link prompting an admin to perform an action. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, further suggesting low active exploitation. However, if an attacker can trick an administrator, the impact is severe due to remote code execution.