The MAS Videos plugin through version 1.3.4 lacks a capability or ownership check when processing front‑end requests to delete videos or playlists. The nonce it validates is bound only to a static action and not to the specific object targeted. This flaw allows any authenticated user with a minimal role, such as a Subscriber+, to permanently delete other users’ posts, pages, attachments and other content. The impact is a full loss of integrity for the affected content and potential denial of service if critical assets are removed.

The affected vendor/product is the MAS Videos WordPress plugin, versions up to and including 1.3.4. No specific patch version is listed in the CNA data, but the vulnerability is tied to the publicly available plugin in the WordPress ecosystem.

The exploit requires only that the attacker be able to authenticate to the WordPress site with a role that has basic access. The attacker can then trigger the delete_video or delete_playlist action and delete arbitrary content. The EPSS score is not provided, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score is not available in the supplied data, but the lack of proper authorization coupled with the ability to delete arbitrary content suggests a severe risk. The typical attack vector is an authenticated user session interacting with the front‑end deletion endpoints.