CVE-2026-107907 MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-107907?
CVE-2026-107907 is a medium-severity vulnerability in Unknown MAS Videos, published on 24 Oct 2026.
Official description
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
Weakness: CWE-862
Which versions are affected by CVE-2026-107907?
How do I fix CVE-2026-107907?
No fix has been published for CVE-2026-107907 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-107907 being exploited?
There is no known exploitation of CVE-2026-107907 in the wild and no public exploit code.
Sources
Also known as GHSA-4w67-w4g6-34xj.