All vulnerabilities
CVE-2026-107907

MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist

Unknown MAS Videos
Open in ThreatlineRecord JSON
CVSS
6.5Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 24 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version yet
Published24 Oct 2026Updated 24 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version.

Description

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

Text from CVE List

Affected versions 1

  • MAS Videosaffected: all versions through 1.3.4CVE List

References 1