Technical impact
The MAS Videos plugin through version 1.3.4 lacks a capability or ownership check when processing front‑end requests to delete videos or playlists. The nonce it validates is bound only to a static action and not to the specific object targeted. This flaw allows any authenticated user with a minimal role, such as a Subscriber+, to permanently delete other users’ posts, pages, attachments and other content. The impact is a full loss of integrity for the affected content and potential denial of service if critical assets are removed.
Affected Systems
The affected vendor/product is the MAS Videos WordPress plugin, versions up to and including 1.3.4. No specific patch version is listed in the CNA data, but the vulnerability is tied to the publicly available plugin in the WordPress ecosystem.
Risk and Exploitability
The exploit requires only that the attacker be able to authenticate to the WordPress site with a role that has basic access. The attacker can then trigger the delete_video or delete_playlist action and delete arbitrary content. The EPSS score is less than 1%, indicating a very low exploitation probability, and the vulnerability is not listed in CISA's KEV catalog. The CVSS score of 6.5 indicates moderate severity. The typical attack vector is an authenticated user session interacting with the front‑end deletion endpoints.
