EUVD-2026-109229
GHSA-4w67-w4g6-34xj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate as minimal-role user
-
ExploitObtain static-action nonce
-
ExecutionSend forged front-end deletion request
-
ImpactPermanently delete arbitrary posts and attachments
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated account of any minimal role (e.g. Subscriber) on a WordPress site with MAS Videos ≤1.3.4 installed and its front-end video/playlist deletion feature reachable; the verified nonce is tied only to a static action, so it is trivially obtainable and provides no per-object protection. The principal limiting factor is the authentication requirement (PR:L) - an attacker must have a valid account, making sites with open/self-service user registration materially more exposed than those that restrict account creation. No special non-default configuration, user interaction, or elevated privilege is needed beyond holding a low-privilege account. |
| Impact | This is a genuine but moderate-priority broken-access-control flaw rather than a critical emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N, base 6.5) correctly captures the shape: network-reachable, low-complexity, but requiring low-privilege authentication (PR:L) with high integrity impact (arbitrary content deletion) and no confidentiality or availability impact as scored. CWE-862 (Missing Authorization) matches the description - the handler performs no capability or ownership check and the nonce is tied to a static action rather than the target object, so authorization is effectively absent for any logged-in user. The supporting signals are consistent and point to limited urgency: EPSS is 0.18% (7th percentile), the flaw is not listed in CISA KEV, and the input's decision label is 'this_month' (not act_now/emergency). A public PoC reference exists (WPScan) but it is not verified as working exploit code, so active, widespread exploitation is not indicated. The main caveat is the gating factor of PR:L - exploitation requires a registered account, so real-world risk rises sharply on sites that permit open user registration and falls on sites where accounts are tightly controlled. No conflicting signals are present, though note the vendor is listed as 'unknown' in the CPE and no fixed version is provided in the available data. |
| Exploit ScenarioDerived | An attacker registers (or already holds) a minimal-role account such as Subscriber on a WordPress site running MAS Videos ≤1.3.4, then sends a forged front-end video/playlist deletion request using the static-action nonce. Because no capability or ownership check is enforced, the request permanently deletes posts, pages, attachments or other content owned by other users. A public PoC reference exists via WPScan, but it is not verified as working exploit code. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 24, 2026
Any authenticated user holding even a minimal role such as Subscriber on a WordPress site running the MAS Videos plugin through 1.3.4 can permanently delete arbitrary posts, pages, attachments and other users' content, because the plugin's front-end video and playlist deletion handlers perform no capability or ownership check and verify a nonce tied only to a static action rather than to the targeted object. The issue is rated CVSS 6.5 (AV:N/AC:L/PR:L/UI:N/C:N/I:H/A:N) under CWE-862 Missing Authorization, with the authentication prerequisite being the principal limiting factor - sites that permit open or self-service registration are materially more exposed than those that restrict account creation. Exploitation status: no public exploit identified at time of analysis beyond a public PoC reference that is not verified as working exploit code; there is no CISA KEV entry, EPSS is 0.18% (7th percentile), and the vuln.today decision label is this_month.
RemediationAI
No vendor-released patch identified at time of analysis: the available intelligence lists MAS Videos through 1.3.4 as affected and does not publish a fixed version, so confirm the current release status with the plugin author and check the WPScan advisory at https://wpscan.com/vulnerability/00de2695-275a-471e-bd64-9a8c54235c23/ before upgrading. Until a fixed build is confirmed, the most effective step is to deactivate and remove the plugin if the front-end video/playlist feature is not essential - the trade-off is loss of that functionality, but it eliminates the vulnerable handler entirely. Where the plugin must stay active, disable or block access to the front-end video and playlist deletion actions (for example by removing the delete controls/templates or blocking the corresponding request parameters at the web server or WAF), accepting that this is a targeted workaround that must be re-verified after any plugin update. Reduce the attack surface by closing open/self-service user registration and auditing existing low-privilege accounts, since a Subscriber-level account is the only prerequisite for exploitation; this will not stop an already-registered malicious user. Finally, review recent post, page and attachment deletions for unauthorized activity and restore affected content from backups, noting that deletions performed through the plugin may not be recoverable without a backup copy.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
MAS Videos is a WordPress plugin that exposes front-end video and playlist management, including deletion actions reachable by logged-in visitors. In the affected code path, the deletion request handler omits any current_user_can() capability test and any post-author/ownership comparison against the object identified in the request, and its nonce is bound to a fixed action string rather than to the specific post or playlist being removed. The result is a classic CWE-862 Missing Authorization condition: the nonce check provides CSRF-style request-origin assurance for a generic action but no per-object authorization, so a low-privilege account can direct the handler at any post ID and have it deleted via the standard WordPress post-deletion APIs. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N) reflects remote reachability, low attack complexity, and an integrity-only impact; the PR:L metric is the sole meaningful barrier, and no elevated privilege, user interaction, or non-default configuration is required beyond holding a valid account. The CPE record cpe:2.3:a:unknown:mas_videos:*:*:*:*:*:*:*:* carries an unassigned vendor field, and the affected range is bounded at version 1.3.4 or earlier per the EUVD entry. The trigger is described in the available sources as an unauthenticated-in-authorization deletion request from an authenticated low-privilege session; no further exploitation mechanics are documented, and the PoC reference is not verified as working exploit code.
Know when Mas Videos gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
Network-reachable front-end request with low complexity, but a registered low-privilege account is required so PR:L; arbitrary content deletion gives I:H, with no confidentiality or scope change.
Primary rating from Vendor (WPScan).
CVSS VectorVendor: WPScan
Lifecycle Timeline
2DescriptionCVE.org
The MAS Videos WordPress plugin through 1.3.4 does not perform any capability or ownership check when handling its front-end video and playlist deletion requests, and the nonce it verifies is tied only to a static action rather than to the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary posts, pages, attachments and other content belonging to other users.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Exploit-DB