CVE-2026-31916: 
WordPress vulnerability analysis and mitigation

CVE-2026-31916 is a Missing Authorization (Broken Access Control) vulnerability in the WordPress plugin "Latest Post Shortcode" by Iulia Cazan. It affects all versions up to and including 14.2.1, allowing unauthenticated remote attackers to exploit incorrectly configured access control security levels. The vulnerability was reported on January 4, 2026, by researcher Doan Dinh Van and published on February 3, 2026, by Patchstack. It carries a CVSS v3.1 base score of 5.3 (Medium) (Patchstack).

The vulnerability is classified as CWE-862 (Missing Authorization), meaning one or more functions within the plugin fail to perform adequate authorization checks before executing privileged actions. An unauthenticated remote attacker can send crafted network requests to trigger these unprotected functions, bypassing intended access controls without requiring any credentials or user interaction. The attack vector is network-based, with low complexity and no privileges required, making it straightforward to exploit at scale (Patchstack).

Successful exploitation results in a limited integrity impact — an unauthenticated attacker can perform actions that should be restricted to higher-privileged users, with no direct confidentiality or availability impact. While the individual impact per site is low, Patchstack notes that vulnerabilities of this class are commonly used in mass-exploit campaigns targeting thousands of WordPress sites simultaneously, regardless of site size or popularity (Patchstack).

No public proof-of-concept exploit code or confirmed in-the-wild exploitation has been reported for this vulnerability. The EPSS score is approximately 0.017% (0.000170), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. The vulnerability was assigned by Patchstack and is classified as low priority (Patchstack).

The vendor has released version 14.2.2 of the Latest Post Shortcode plugin, which resolves this vulnerability. Site administrators should update to version 14.2.2 or later immediately via the WordPress plugin dashboard. Patchstack users can enable auto-update for vulnerable plugins as an additional safeguard. If an immediate update is not possible, site owners should consult their hosting provider or web developer for assistance (Patchstack).