The vulnerability identified as CVE-2026-31916 affects the Latest Post Shortcode plugin by Iulia Cazan. It is caused by missing authorization controls, allowing unauthorized users to exploit incorrectly configured access control security levels. The affected versions include all versions up to and including 14.2.1. The CVSS score is 5.3 (medium severity), with an attack vector of network, low attack complexity, no privileges required, no user interaction, and impact limited to integrity.

The vulnerability allows unauthorized modification or manipulation of certain plugin functions or data due to missing authorization checks. It does not affect confidentiality or availability but can impact data integrity within the plugin's scope. No known active exploitation has been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no patch or official fix information is provided, users should monitor the vendor's communications for updates. Until a fix is available, consider restricting access to the plugin's functionalities or disabling it if feasible to reduce risk.