The vulnerability is a missing authorization flaw, classified as CWE-862, in the WordPress Latest Post Shortcode plugin up to version 14.2.1. It allows an attacker to bypass the plugin’s configured access control settings and view content that should otherwise be restricted, such as drafts or private posts. The flaw does not explicitly provide a way to modify content, so the primary impact is a confidentiality breach.

This issue affects the Iulia Cazan Latest Post Shortcode plugin in all releases from the earliest available version through version 14.2.1 inclusive. Any WordPress site that has this plugin installed and enabled in any of those versions is vulnerable.

The CVSS score of 5.3 indicates moderate severity. The EPSS score of less than 1% indicates that exploitation is unlikely in the wild, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be web-based; an attacker could reach the vulnerable code via any HTTP request that triggers the shortcode processing, provided appropriate role checks are missing.