CVE-2026-107907 Details
Description
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
A vulnerability in the MAS Videos WordPress plugin, affecting versions through 1.3.4, allows any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments, and other content belonging to other users. This issue arises because the plugin does not perform proper capability or ownership checks when processing front-end video and playlist deletion requests. Additionally, the nonce verification is only linked to a static action, rather than the specific object being targeted.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 24, 2026CISA-ADP
Assessed Oct 24, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://wpscan.com/vulnerability/00de2695-275a-471e-bd64-9a8c54235c23/ | [email protected] | AdvisoryExploitPartial Content |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-862 | Missing Authorization | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| MAS Videos | <= 1.3.4 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 24, 2026 | CVE Modified | CISA-ADP |
| Oct 24, 2026 | New CVE Received | [email protected] |