The vulnerability identified as CVE-2026-31916 involves missing authorization checks in the Latest Post Shortcode plugin by Iulia Cazan, versions up to 14.2.1. This results in incorrect access control security levels, permitting unauthorized access to certain plugin functionalities or data. The CVSS 3.1 score of 5.3 reflects a medium severity with network attack vector, low attack complexity, no privileges required, no user interaction, and an impact limited to confidentiality. There is no vendor advisory or patch information provided, and the plugin is not a cloud service.

The impact is limited to confidentiality loss due to missing authorization controls, allowing unauthorized users to access data or functionality that should be restricted. There is no reported impact on integrity or availability. No known exploits have been observed in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the affected plugin or disabling it if possible to reduce exposure.