CVE-2026-31916

Latest Post Shortcode <= 14.2.1 - Missing Authorization

mediumMissing Authorization

5.3

CVSS Score

5.3

CVSS Score

medium

Severity

14.2.2

Patched in

72d

Time to patch

Description

The Latest Post Shortcode plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 14.2.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

None

Confidentiality

Low

Integrity

None

Availability

Technical Details

Affected versions<=14.2.1

PublishedFebruary 3, 2026

Last updatedApril 15, 2026

Affected pluginlatest-post-shortcode

What Changed in the Fix

Changes introduced in v14.2.2

Loading patch diff...

Source Code

WordPress.org SVN

Vulnerable v14.2.1

Browse source Download .zip

Patched v14.2.2

Browse source Download .zip

Research Plan

Unverified

This research plan targets a missing authorization vulnerability in the **Latest Post Shortcode** plugin (CVE-2026-31916). Based on the provided source code and patch analysis, the vulnerability exists in an AJAX handler responsible for saving settings from the plugin's "Settings Modal," which is re…

Show full research plan

This research plan targets a missing authorization vulnerability in the Latest Post Shortcode plugin (CVE-2026-31916). Based on the provided source code and patch analysis, the vulnerability exists in an AJAX handler responsible for saving settings from the plugin's "Settings Modal," which is registered for unauthenticated users without capability checks.

1. Vulnerability Summary

Vulnerability: Missing Authorization (Unauthenticated Settings Modification)
Location: Likely a function named lps_save_settings (inferred) within the Latest_Post_Shortcode or an Admin class.
Affected Version: <= 14.2.1
Why it exists: The plugin registers an AJAX action for both authenticated and unauthenticated (nopriv) users to save modal settings but fails to perform a current_user_can('manage_options') check inside the handler. This allows any user to modify plugin-wide configurations.

2. Attack Vector Analysis

Endpoint: /wp-admin/admin-ajax.php
Action: lps_save_settings (inferred)
Payload Parameter: settings (carrying the configuration data)
Nonce Parameter: verify (verified against the action lps-modal-actions)
Authentication: None Required (nopriv hook)
Preconditions: An attacker must obtain a valid nonce for the lps-modal-actions action, which is often leaked on pages where the plugin's assets are enqueued.

3. Code Flow

Entry Point: An unauthenticated user sends a POST request to admin-ajax.php with the action lps_save_settings.
Hook Registration: The plugin (in the main file, not provided) likely contains:
add_action( 'wp_ajax_nopriv_lps_save_settings', [ $this, 'lps_save_settings' ] );
Nonce Verification: The handler calls check_ajax_referer( 'lps-modal-actions', 'verify' );.
Vulnerable Sink: The handler proceeds to update options using update_option() based on the settings parameter without checking if the user has the manage_options capability.

4. Nonce Acquisition Strategy

The nonce lps-modal-actions is generated in incs/assets.php inside the use_script_modal() function and localized into the lpsGenVars JavaScript object.

Localization Key: lpsGenVars
Nonce Key: verify
Strategy:
1. Create a page with the plugin's primary shortcode to trigger asset

Research Findings

Static analysis — not yet PoC-verified

Summary

The Latest Post Shortcode plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check in an AJAX handler registered for unauthenticated users. This allows an attacker to obtain a valid nonce from the front-end and send a crafted request to modify the plugin's configuration settings.

Vulnerable Code

// incs/assets.php line 132
function use_script_modal() {
	if ( ! \wp_script_is( 'lps-admin-shortcode-button' ) ) {
		$lps = \Latest_Post_Shortcode::get_instance();

		\wp_register_script(
			'lps-admin-shortcode-button',
			LPS_PLUGIN_URL . 'assets/modal.js',
			[ 'jquery' ],
			ver(),
			false
		);
		\wp_localize_script( 'lps-admin-shortcode-button', 'lpsGenVars', [
			'ajaxUrl'     => \admin_url( 'admin-ajax.php' ),
			'verify'      => \wp_create_nonce( 'lps-modal-actions' ),
			'icon'        => LPS_PLUGIN_URL . 'assets/images/icon-purple.svg',
			'title'       => \esc_html__( 'Latest Post Shortcode', 'lps' ),
			'outputTypes' => implode( ' ', array_filter( array_keys( $lps::get_card_output_types() ) ) ),
			'allowIcon'   => $lps::allow_icon_for_roles(),
		] );
		\wp_enqueue_script( 'lps-admin-shortcode-button' );
	}
}

Security Fix

diff -ru /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.1/changelog.txt /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.2/changelog.txt
--- /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.1/changelog.txt	2026-01-18 08:59:32.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.2/changelog.txt	2026-02-09 19:40:46.000000000 +0000
@@ -1,5 +1,12 @@
 == Changelog ==
 
+= 14.2.1 =
+* Tested up to 6.9
+* Styles changes to allow for gradient as card background
+* Fixed the mood toggle when the card background color changes
+* Bundler output files with functions assigned to window (global variable)
+* Fixed the cache reset vunerability
+
 = 14.2.0 =
 * Tested up to 6.8.3
 * PHP 8.4 compatibility
diff -ru /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.1/incs/assets.php /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.2/incs/assets.php
--- /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.1/incs/assets.php	2026-01-18 08:59:32.000000000 +0000
+++ /home/deploy/wp-safety.org/data/plugin-versions/latest-post-shortcode/14.2.2/incs/assets.php	2026-02-09 19:40:46.000000000 +0000
@@ -1,4 +1,4 @@
-<?php //phpcs:ignore Generic.Files.LineEndings.InvalidEOLChar
+<?php // phpcs:disable Generic.Files.LineEndings.InvalidEOLChar
 /**
  * Latest Post Shortcode slider output.
  * Text Domain: lps
@@ -6,12 +6,13 @@
  * @package lps
  */
 
+// phpcs:disable WordPress.WP.I18n.TextDomainMismatch
+// phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound
+
 declare( strict_types = 1 );
 namespace LPS;
 
-if ( ! defined( 'ABSPATH' ) ) {
-	exit; // Exit if accessed directly.
-}
+defined( 'ABSPATH' ) || exit;
 
 \add_action( 'admin_enqueue_scripts', __NAMESPACE__ . '\\use_script_inline', 0 );
 \add_action( 'wp_enqueue_scripts', __NAMESPACE__ . '\\use_script_inline', 0 );
... (truncated at 18000 of 112549 chars — patch_diff)

Exploit Outline

The exploit targets an unauthenticated AJAX action that saves plugin settings. First, an attacker accesses any page where the plugin's modal assets are loaded to retrieve a valid nonce for the 'lps-modal-actions' action from the localized 'lpsGenVars' JavaScript object. Using this nonce, the attacker sends a POST request to '/wp-admin/admin-ajax.php' with the 'action' parameter set to the settings-saving handler (likely 'lps_save_settings') and the 'verify' parameter containing the nonce. The payload includes a 'settings' parameter with malicious configuration data. Because the handler is registered with 'wp_ajax_nopriv_' and fails to verify the 'manage_options' capability, it processes the request and updates the plugin's global options.

References

https://www.wordfence.com/threat-intel/vulnerabilities/id/190c8744-b8e0-4722-ae0a-f18d7c058dfe?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database