The vulnerability CVE-2026-24995 in the Latest Post Shortcode plugin by Iulia Cazan is caused by missing authorization checks, leading to incorrect access control. This allows an attacker with low privileges to potentially cause availability disruptions. The affected versions include all versions up to and including 14.2.0. The CVSS score is 4.3 (medium), reflecting network attack vector, low attack complexity, low privileges required, no user interaction, unchanged scope, and impact limited to availability.

The impact is limited to availability disruption without affecting confidentiality or integrity. An attacker with low privileges can exploit the missing authorization to cause denial of service or other availability issues. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor vendor communications for updates. Until a fix is available, restrict access to the plugin functionality to trusted users only and review access control configurations to minimize exposure.