CVE-2026-107907
MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
| Vendor | unknown |
| Product | mas videos |
| Published | Oct 24, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown mas videos
Be the first to know when new unknown vulnerabilities affecting unknown mas videos are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / MAS Videos
0 ≤ 1.3.4
References
Credits
JunHee CHO WPScan