---
id: CVE-2026-107907
title: >-
  MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via
  delete_video/delete_playlist
summary: >-
  The MAS Videos WordPress plugin through 1.3.4 does not perform any capability
  or ownership check when handling its front-end video and playlist deletion
  requests, and the nonce it verifies is tied only to a static action rather
  than to t…
severity: none
cwe:
  - CWE-862
product: MAS Videos
affected:
  - mas_videos <= 1.3.4
published: '2026-10-24'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T06:00:17.918Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-107907'
references:
  - url: 'https://wpscan.com/vulnerability/00de2695-275a-471e-bd64-9a8c54235c23/'
tags:
  - cve.org
ingestedAt: '2026-10-24T06:53:46.605Z'
---

## Overview

The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.

## Affected

- `mas_videos <= 1.3.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.