A block can hold thousands of transactions, but its header is only 80 bytes. The Merkle root is how it commits to them all in 32 bytes.
How it is built
Take the txid of every transaction. Pair them up and hash each pair with double SHA-256. Pair up the results and repeat, until one hash remains: the root. If a level has an odd number of items, the last one is paired with itself.
Why it is useful
To prove a transaction is in a block, you only need the hashes along its branch, about log2(n) of them. For a block with 4,000 transactions, that is just 12 hashes. Satoshi's white paper called this Simplified Payment Verification (SPV).
A known quirk
Because the last item is duplicated, two different transaction lists can produce the same root. This was the bug CVE-2012-2459, and Bitcoin Core now rejects blocks that contain duplicate transactions in this way.