{"id":"CVE-2026-107907","kind":"vulnerability","aliases":["CVE-2026-107907"],"related":[],"title":"MAS Videos WordPress plugin lets any logged-in user delete others' content","description":"The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.","summary":"The MAS Videos WordPress plugin through 1.3.4 performs no capability or ownership check on its front-end video and playlist deletion requests. Any authenticated user with a minimal role can permanently delete posts, pages, attachments and other users' content.","severity":"high","cvss":null,"epss":0.0018,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","wordpress","wordpress-plugin"],"not_affected_if":["no-authenticated-users","plugin-not-installed"],"how_to_check":"- Check the installed version of the MAS Videos plugin in the WordPress admin plugin list, or with `wp plugin get mas-videos --field=version` (unknown whether this slug is correct)\n- Look for subscriber-level accounts that can reach the plugin's front-end deletion handlers\n- unknown whether the sources give a specific file or setting to inspect","fix":"- Update the MAS Videos plugin to a version later than `1.3.4`\n- If no fixed version exists, deactivate the plugin\n- unknown whether the sources name a patched release","status":"open","published_at":"2026-10-24T06:16:35+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","triaged_at":"2026-10-25T04:52:00+00:00","updated_at":"2026-10-25T12:38:49+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-25T04:52:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the MAS Videos plugin to a version later than `1.3.4`\n- If no fixed version exists, deactivate the plugin\n- unknown whether the sources name a patched release","reach":"internet","title":"MAS Videos WordPress plugin lets any logged-in user delete others' content","impact":"high","summary":"The MAS Videos WordPress plugin through 1.3.4 performs no capability or ownership check on its front-end video and playlist deletion requests. Any authenticated user with a minimal role can permanently delete posts, pages, attachments and other users' content.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","self-hosted"],"confidence":0.7,"needs_auth":"yes","worst_case":"Any logged-in low-privilege user permanently deletes other users' posts and attachments.","analyst_note":"Confirm the affected version range, the fixed release and the plugin slug from the NVD entry or the WordPress plugin page.","how_to_check":"- Check the installed version of the MAS Videos plugin in the WordPress admin plugin list, or with `wp plugin get mas-videos --field=version` (unknown whether this slug is correct)\n- Look for subscriber-level accounts that can reach the plugin's front-end deletion handlers\n- unknown whether the sources give a specific file or setting to inspect","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-authenticated-users"],"who_is_affected":"Sites running the MAS Videos plugin at version `1.3.4` or earlier where users can hold a minimal role, such as subscriber, that can send the front-end deletion requests. Sites without the plugin installed, or with it removed, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3335,"output_tokens":629,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-107907':16A,19A '-2026':15A,18A '1.3.4':34B,74C 'action':105C 'allow':112C 'arbitrari':123C 'attach':63B,126C 'authent':52B,114C 'belong':130C 'capabl':37B,79C 'check':40B,82C 'content':13A,67B,129C 'cve':14A,17A 'delet':11A,49B,60B,92C,122C 'end':45B,88C 'front':44B,87C 'front-end':43B,86C 'handl':84C 'host':23B 'let':5A 'log':8A 'logged-in':7A 'mas':1A,29B,69C 'minim':56B,118C 'nonc':96C 'object':111C 'other':12A 'ownership':39B,81C 'packag':20B 'page':62B,125C 'perform':35B,77C 'perman':59B,121C 'playlist':48B,91C 'plugin':4A,27B,32B,72C 'post':61B,124C 'rather':106C 'request':50B,93C 'role':57B,119C 'self':22B 'self-host':21B 'static':104C 'target':110C 'tie':100C 'user':10A,53B,66B,115C,133C 'verifi':98C 'video':2A,30B,46B,70C,89C 'wordpress':3A,24B,26B,31B,71C 'wordpress-plugin':25B","nicknames":[],"mitigations":[],"who_affected":"Sites running the MAS Videos plugin at version `1.3.4` or earlier where users can hold a minimal role, such as subscriber, that can send the front-end deletion requests. Sites without the plugin installed, or with it removed, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-24T06:16:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107907","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107907","severity":null,"published_at":"2026-10-24T06:16:35+00:00","modified_at":"2026-10-24T06:16:35+00:00","first_seen_at":"2026-10-24T06:47:03+00:00","fetched_at":"2026-10-24T06:47:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107907","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107907","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-25T12:38:49+00:00","fetched_at":"2026-10-25T12:38:49+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}