Technical impact
A missing authorization flaw in the Iulia Cazan Latest Post Shortcode plugin allows users to bypass configured access control settings. The weakness is a classic broken access control vulnerability (CWE-862) and can enable an unauthenticated or low‑privilege visitor to read or expose recent post content from the shortcode functionality that should normally be restricted.
Affected Systems
Any WordPress site that has installed the Iulia Cazan Latest Post Shortcode plugin version 14.2.0 or earlier is potentially vulnerable. The plugin is used to insert the most recent post into pages or posts via shortcodes, and the affected releases span from the earliest versions up through 14.2.0.
Risk and Exploitability
Based on the description, it is inferred that attackers would most likely target the plugin’s web interface or shortcode rendering functions, exploiting incorrect role checks to retrieve or display content that should have been hidden. The CVSS base score of 4.3 indicates a low‑to‑moderate severity, and the EPSS score of less than 1% shows a very low probability of exploitation at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog. Because the weakness leverages incorrect authorization, any user who can inject or request the shortcode could potentially view private posts if access controls are misconfigured.
