{"id":71093,"date":"2025-09-03T23:41:12","date_gmt":"2025-09-03T23:41:12","guid":{"rendered":""},"modified":"2025-10-02T00:14:29","modified_gmt":"2025-10-02T06:14:29","slug":"cve-2025-7812-critical-cross-site-request-forgery-vulnerability-in-video-share-vod-wordpress-plugin","status":"publish","type":"post","link":"https:\/\/www.ameeba.com\/blog\/cve-2025-7812-critical-cross-site-request-forgery-vulnerability-in-video-share-vod-wordpress-plugin\/","title":{"rendered":"CVE-2025-7812: Critical Cross-Site Request Forgery Vulnerability in Video Share VOD WordPress Plugin<\/strong>"},"content":{"rendered":"

Overview<\/strong><\/p>\n

In the digital landscape, WordPress plugins are often an easy target for cybercriminals due to their widespread use and occasional security oversights. The latest to join the list of vulnerable plugins is the Video Share VOD – Turnkey Video Site Builder Script plugin, which has been found to possess a critical Cross-Site Request Forgery (CSRF) vulnerability. This flaw, identified as CVE-2025-7812, can potentially allow unauthenticated attackers to perform damaging actions<\/a>, provided they can deceive a site administrator into clicking on a malicious link.
\nThe severity of this issue lies in its potential for system<\/a> compromise or data leakage, thereby threatening the security of countless websites powered by WordPress and using this plugin. Given the CVSS Severity Score of 8.8, we understand the urgency to address this vulnerability<\/a> promptly.<\/p>\n

Vulnerability Summary<\/strong><\/p>\n

CVE ID: CVE-2025-7812
\nSeverity: High (CVSS: 8.8)
\nAttack Vector: Network
\nPrivileges Required: None
\nUser Interaction: Required
\nImpact: Potential system<\/a> compromise or data leakage<\/p>\n

Affected Products<\/strong><\/p>\n

Product | Affected Versions<\/p>\n

Video Share VOD – Turnkey Video Site Builder Script<\/a> Plugin | Up to and including 2.7.6<\/p>\n

How the Exploit Works<\/strong><\/p>\n

CVE-2025-7812 is a CSRF vulnerability that originates from missing or incorrect<\/a> nonce validation within the adminExport() function of the Video Share VOD plugin. This flaw makes it possible for attackers to send forged requests impersonating the administrator.
\nThe crux of the exploit lies in tricking a site administrator into performing an action such as clicking on a malicious link. Once this happens, unauthenticated attackers can alter settings and execute remote code<\/a>, especially if the server command execution setting is enabled.<\/p>\n

Conceptual Example Code<\/strong><\/p>\n

Below is a conceptual example of how the vulnerability might be exploited, in this case, a malicious HTTP request:<\/p>\n

POST \/wp-admin\/admin-ajax.php?action=vs_export HTTP\/1.1\nHost: target.example.com\nContent-Type: application\/json\n{\n\"settings\": {\n\"server_command\": \"enabled\",\n\"command_to_execute\": \"malicious_command_here\"\n}\n}<\/code><\/pre>\n
In this example, the attacker is trying to enable the server command execution<\/a> setting and then execute a malicious command. All of this could be part of a CSRF attack, where the request is sent from the administrator’s browser without their knowledge.<\/p>\n","protected":false},"excerpt":{"rendered":"
Overview In the digital landscape, WordPress plugins are often an easy target for cybercriminals due to their widespread use and occasional security oversights. The latest to join the list of vulnerable plugins is the Video Share VOD – Turnkey Video Site Builder Script plugin, which has been found to possess a critical Cross-Site Request Forgery […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[1],"tags":[],"vendor":[],"product":[],"attack_vector":[90,80],"asset_type":[],"severity":[],"exploit_status":[],"class_list":["post-71093","post","type-post","status-publish","format-standard","hentry","category-uncategorized","attack_vector-csrf","attack_vector-rce"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t