CVE-2025-14390: 
WordPress vulnerability analysis and mitigation

CVE-2025-14390 is a Cross-Site Request Forgery (CSRF) vulnerability combined with unrestricted file upload in the Video Merchant plugin for WordPress, affecting versions 5.0.4 and earlier. The flaw stems from missing or incorrect nonce validation in the video_merchant_add_video_file() function, enabling unauthenticated attackers to upload arbitrary files — including web shells — that can lead to remote code execution, provided they can trick a site administrator into clicking a malicious link. It was published on December 10, 2025, with Wordfence credited as the assigner. The vulnerability carries a CVSS v3.1 base score of 8.8 (High) (Wordfence, Red Hat CVE).

The root cause is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type), compounded by the absence of proper CSRF nonce validation (CWE-352) in the video_merchant_add_video_file() function. An attacker crafts a forged HTTP request targeting this function and socially engineers a logged-in WordPress administrator into triggering it — for example, by embedding the request in a malicious webpage or link. Because no nonce is verified, the server processes the request as legitimate, allowing the attacker to upload arbitrary file types (e.g., PHP web shells) to the server. No authentication is required on the attacker's side; only administrator interaction is needed (Wordfence, ENISA EUVD).

Successful exploitation allows an attacker to upload arbitrary files — most critically PHP web shells — to the WordPress server, resulting in remote code execution with the privileges of the web server process. This can lead to full site compromise, including unauthorized access to sensitive data, modification or deletion of site content, installation of backdoors, and potential lateral movement to other systems on the same hosting environment. All three security pillars — confidentiality, integrity, and availability — are rated as High impact (Wordfence, ENISA EUVD).

As of the time of reporting, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Wordfence). The EPSS score is approximately 0.084%, indicating a low current probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires social engineering of a site administrator, which raises the practical bar compared to fully unauthenticated attack chains.

1. Reconnaissance: Identify WordPress sites running the Video Merchant plugin version ≤ 5.0.4 using tools like WPScan, Shodan, or Google dorks targeting plugin-specific paths (e.g., /wp-content/plugins/video-merchant/).
2. Craft forged request: Construct a malicious HTML page or link containing a hidden form or auto-submitting CSRF payload that calls the video_merchant_add_video_file() function endpoint with a malicious file (e.g., a PHP web shell) as the upload parameter.
3. Social engineering: Deliver the malicious link or page to a WordPress site administrator via phishing email, forum post, or other social engineering vector, inducing them to visit the page while authenticated to their WordPress dashboard.
4. File upload: When the administrator's browser loads the attacker's page, the forged request is automatically submitted to the target WordPress site. Due to missing nonce validation, the server accepts and stores the uploaded file.
5. Remote code execution: Access the uploaded web shell via its URL (e.g., https://target-site.com/wp-content/uploads/<shell.php>) to execute arbitrary commands on the server and achieve full site compromise (Wordfence).

• File System: Unexpected PHP files (e.g., .php, .phtml) in WordPress upload directories such as wp-content/uploads/ or plugin-specific directories; files with obfuscated content or eval(base64_decode(...)) patterns.
• Logs: WordPress or web server access logs showing POST requests to the video_merchant_add_video_file() endpoint from unexpected or external referrers; subsequent GET requests to newly created PHP files in upload directories.
• Network: Outbound connections from the web server process to unknown external IPs following a file upload event; unusual DNS lookups or reverse shell traffic originating from the web server.
• Process: Unexpected child processes spawned by the web server (e.g., Apache, Nginx, PHP-FPM) such as bash, curl, wget, or python with external network connections.

The primary remediation is to update the Video Merchant plugin to a version newer than 5.0.4, which addresses the missing nonce validation (Wordfence). If an immediate update is not possible, site administrators should consider deactivating the plugin until a patch is applied. Additional hardening measures include deploying a Web Application Firewall (WAF) with rules to detect CSRF and unrestricted file upload attempts, restricting file upload directories from executing PHP, and training administrators to avoid clicking unsolicited links while logged into the WordPress dashboard.

Wordfence included CVE-2025-14390 in their weekly WordPress vulnerability report for December 8–14, 2025, highlighting it as part of a broader set of plugin vulnerabilities disclosed that week (Wordfence Blog). The vulnerability was also referenced in the Secret CISO newsletter and picked up by automated CVE tracking feeds including VulDB, Vulners, and CIRCL's vulnerability lookup service. No significant independent researcher commentary or major media coverage beyond routine CVE aggregation has been observed.