CVE-2026-107907 MAS Videos CVE debrief

Who should care

WordPress administrators, security teams, and users with minimal roles should assess exposure and verify the presence of this vulnerability in their installations. They should also review user role configurations and restrict access to sensitive content to prevent unauthorized content deletion and data loss.

Why it matters

CVE-2026-107907 allows authenticated users with minimal roles to delete arbitrary content, posing a risk to content integrity and user trust. Defenders should verify and mitigate this vulnerability, especially in multi-user WordPress installations.

• Potential unauthorized content deletion by authenticated users
• Increased risk of data loss and content manipulation
• Need for verification of plugin version and user role configurations
• Potential impact on content integrity and user trust

Technical summary

The MAS Videos WordPress plugin through 1.3.4 does not perform proper capability or ownership checks when handling front-end video and playlist deletion requests. The nonce verification is tied to a static action rather than the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary content belonging to other users. This vulnerability could lead to unauthorized content deletion, data loss, and content manipulation in multi-user WordPress installations. Defenders should prioritize verifying and mitigating this vulnerability in their WordPress installations, especially those with multiple users or minimal role assignments.

Defensive priority

Defenders should prioritize verifying and mitigating this vulnerability in their WordPress installations, especially those with multiple users or minimal role assignments.

Recommended defensive actions

• Verify and update the MAS Videos WordPress plugin to a fixed version
• Restrict access to sensitive content and user roles
• Monitor for suspicious deletion requests
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was reported by WPScan, and the CVE record is based on information from the NVD and CVE Program. The MAS Videos WordPress plugin through 1.3.4 does not perform proper capability or ownership checks when handling front-end video and playlist deletion requests. The nonce verification is tied to a static action rather than the targeted object, allowing any authenticated user with a minimal role to permanently delete arbitrary content belonging to other users. There may be limited source detail available for this CVE, so

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.