A Cross‑Site Request Forgery flaw in the WP Video Posts plugin allows an attacker to inject OS commands, resulting in remote code execution. The plugin accepts authenticated requests without validating a CSRF token, so a forged request can be delivered to a logged‑in user. Successful exploitation would give the attacker full control over the WordPress site and its underlying server, compromising confidentiality, integrity, and availability.

The vulnerability affects the WP Video Posts plugin from cmstactics. All versions up to and including 3.5.1 are vulnerable. No other products or variants are listed as affected.

The CVSS score of 8.3 marks this issue as high severity. The EPSS score of less than 1% indicates that current exploitation probability is low, yet the attack can be carried out by delivering a forged request to an authenticated user. The vulnerability is not listed in the CISA KEV catalog, so no known active exploits have been reported. Nonetheless, the potential for remote code execution makes it a serious risk when the plugin is in use.