Live › vulnerability › CVE-2026-107907
Go to dashboardThe MAS Videos WordPress plugin through 1.3.4 performs no capability or ownership check on its front-end video and playlist deletion requests. Any authenticated user with a minimal role can permanently delete posts, pages, attachments and other users' content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-24 06:47 UTC. All times on this page are UTC.
Sites running the MAS Videos plugin at version 1.3.4 or earlier where users can hold a minimal role, such as subscriber, that can send the front-end deletion requests. Sites without the plugin installed, or with it removed, are not affected.
No product ranges from the sources yet.
wp plugin get mas-videos --field=version (unknown whether this slug is correct)1.3.4Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
This page as .md · .json · in your agent: get_signal("CVE-2026-107907")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.