The Sell Media plugin for WordPress is vulnerable to a type of cyber attack called Cross-Site Request Forgery. This vulnerability affects versions up to and including 2.5.5. It occurs because the plugin does not properly validate nonce on the sell_media_process() function. This means that an unauthorized user can trick a site administrator into performing an action like clicking on a link, and in turn, sell a media paypal order.