Insecure Access Control in MAS Videos Plugin for WordPress
CVE-2026-107907
Key Information:
- Vendor
WordPress
- Status
- Vendor
- CVE Published:
- 24 October 2026
Badges
What is CVE-2026-107907?
The MAS Videos WordPress plugin prior to version 1.3.4 contains an access control vulnerability that enables any authenticated user, regardless of their role, to delete videos, playlists, and other content that belong to different users. This occurs because the plugin does not implement proper checks for user capabilities or ownership when processing deletion requests. The nonce used for verification is linked to a static action rather than being specific to the targeted content, further compromising security. Site administrators are advised to update the plugin to the latest version to mitigate this risk.
Affected Version(s)
MAS Videos 0 <= 1.3.4
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.