Video Share VOD – Turnkey Video Site Builder Script <= 2.7.6 - Cross-Site Request Forgery to Command Injection
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Tampering
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-352.
Summary
The Video Share VOD – Turnkey Video Site Builder Script plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.7.6. This is due to missing or incorrect nonce validation on the adminExport() function. This makes it possible for unauthenticated attackers to update settings and execute remote code when the Server command execution setting is enabled via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| videowhisper | Video Share VOD – Turnkey Video Site Builder Script | up to 2.7.6 | — | No fix listed | CNA |
- Video Share VOD – Turnkey Video Site Builder Script Vendorvideowhisper Affected up to 2.7.6 Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2025-7812
- 2026-10-03 Alias added: GHSA-4cgj-2rh9-wgfc
References
Other 4
- https://www.wordfence.com/threat-intel/vulnerabilities/id/b9e499c4-e683-4587-b0ab-7f4ecde94e41?source=cve
- https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/video-share-vod.php#L3360
- https://plugins.trac.wordpress.org/browser/video-share-vod/trunk/inc/options.php#L728
- https://plugins.trac.wordpress.org/changeset/3348480/video-share-vod/trunk/video-share-vod.php
More videowhisper vulnerabilities
- TI-2014-01486 Unrestricted file upload vulnerability in ls/vw_snapshots.php in the VideoWhisper Live… CVSS 2.0HIGH 10.0
- TI-2025-22561 WordPress Paid Videochat Turnkey Site plugin <= 7.3.11 - Broken Authentication Vulnerability CVSS 3.1CRITICAL 9.8
- TI-2015-07650 The videowhisper-video-presentation plugin 3.31.17 for WordPress allows remote attackers… CVSS 3.0CRITICAL 9.8
- TI-2015-07649 The VideoWhisper videowhisper-video-conference-integration plugin 4.91.8 for WordPress… CVSS 3.0CRITICAL 9.8
- TI-2023-10975 WordPress VideoWhisper Live Streaming Integration plugin <= 5.5.15 - Remote Code Execution (RCE) CVSS 3.1CRITICAL 9.8
- TI-2026-41268 WordPress Paid Videochat Turnkey Site plugin <= 7.4.8 - Arbitrary File Deletion vulnerability CVSS 3.1CRITICAL 9.9
Sources
- CVE-2025-7812 · CVE Program
- CVE-2025-7812 · NVD
- FIRST EPSS
- GHSA-4cgj-2rh9-wgfc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences