CVE-2026-107907: MAS Videos 0 through 1.3.4

Affected technology

MAS Videos · 0 through 1.3.4
Vendor not specified by the source

Description’s affected range: through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests

Component: Not specified by the source

Attack conditions (Source advisory, CVSS 3.1): Network (remote) · Low privileges required · No user interaction required

What an attacker can do

The source says the MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users. Source advisory’s CVSS 3.1 assessment (base score 6.5/10) rates confidentiality and availability impact as none; integrity impact as high.