The Video Share VOD – Turnkey Video Site Builder Script allows unauthenticated attackers to perform Cross‑Site Request Forgery against the adminExport function because nonce validation is absent or incorrect. A forged request can modify plugin settings and, if the Server command execution option is enabled, trigger remote command execution on the host. This vulnerability is classified as CWE‑352 and can lead to full compromise of the affected WordPress site.

The affected product is the Video Share VOD – Turnkey Video Site Builder Script for WordPress, made by videowhisper. All releases up to and including version 2.7.6 are vulnerable.

The CVSS score of 8.8 categorizes this flaw as high severity, while the EPSS score of less than 1% indicates a low probability of immediate exploitation in the wild. Because the flaw relies on a CSRF attack, an attacker must trick a legitimate administrator into clicking a malicious link or otherwise triggering the forged request. The vulnerability is not currently listed in CISA’s KEV catalog. In practice, the risk is elevated when the site allows the Server command execution setting, as it enables arbitrary code execution once the CSRF succeeds.