[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fOkJ5MeIBxzSzFy6EJ5plxgGarzF4paHUwtHtLqfn9ew":3},{"id":4,"url_slug":5,"title":6,"description":7,"plugin_slug":8,"theme_slug":9,"affected_versions":10,"patched_in_version":11,"severity":12,"cvss_score":13,"cvss_vector":14,"vuln_type":15,"published_date":16,"updated_date":17,"references":18,"days_to_patch":20,"patch_diff_files":21,"patch_trac_url":9,"research_status":30,"research_verified":31,"research_rounds_completed":32,"research_plan":33,"research_summary":34,"research_vulnerable_code":35,"research_fix_diff":36,"research_exploit_outline":37,"research_model_used":38,"research_started_at":39,"research_completed_at":40,"research_error":9,"poc_status":9,"poc_video_id":9,"poc_summary":9,"poc_steps":9,"poc_tested_at":9,"poc_wp_version":9,"poc_php_version":9,"poc_playwright_script":9,"poc_exploit_code":9,"poc_has_trace":31,"poc_model_used":9,"poc_verification_depth":9,"poc_exploit_code_gated":31,"source_links":41},"CVE-2026-31916","latest-post-shortcode-missing-authorization-2","Latest Post Shortcode \u003C= 14.2.1 - Missing Authorization","The Latest Post Shortcode plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 14.2.1. This makes it possible for unauthenticated attackers to perform an unauthorized action.","latest-post-shortcode",null,"\u003C=14.2.1","14.2.2","medium",5.3,"CVSS:3.1\u002FAV:N\u002FAC:L\u002FPR:N\u002FUI:N\u002FS:U\u002FC:N\u002FI:L\u002FA:N","Missing Authorization","2026-02-03 00:00:00","2026-04-15 20:43:18",[19],"https:\u002F\u002Fwww.wordfence.com\u002Fthreat-intel\u002Fvulnerabilities\u002Fid\u002F190c8744-b8e0-4722-ae0a-f18d7c058dfe?source=api-prod",72,[22,23,24,25,26,27,28,29],"changelog.txt","incs\u002Fassets.php","incs\u002Fcontent-slider.php","incs\u002Fdeprecated-extension.php","incs\u002Felementor\u002Fclass-elementor-lps-extension.php","incs\u002Felementor\u002Fcontrols\u002Fclass-lps-control.php","incs\u002Felementor\u002Fwidgets\u002Fclass-lps-widgets.php","incs\u002Fparts\u002Ftabs0.php","researched",false,3,"This research plan targets a missing authorization vulnerability in the **Latest Post Shortcode** plugin (CVE-2026-31916). Based on the provided source code and patch analysis, the vulnerability exists in an AJAX handler responsible for saving settings from the plugin's \"Settings Modal,\" which is registered for unauthenticated users without capability checks.\n\n### 1. Vulnerability Summary\n*   **Vulnerability:** Missing Authorization (Unauthenticated Settings Modification)\n*   **Location:** Likely a function named `lps_save_settings` (inferred) within the `Latest_Post_Shortcode` or an `Admin` class.\n*   **Affected Version:** \u003C= 14.2.1\n*   **Why it exists:** The plugin registers an AJAX action for both authenticated and unauthenticated (`nopriv`) users to save modal settings but fails to perform a `current_user_can('manage_options')` check inside the handler. This allows any user to modify plugin-wide configurations.\n\n### 2. Attack Vector Analysis\n*   **Endpoint:** `\u002Fwp-admin\u002Fadmin-ajax.php`\n*   **Action:** `lps_save_settings` (inferred)\n*   **Payload Parameter:** `settings` (carrying the configuration data)\n*   **Nonce Parameter:** `verify` (verified against the action `lps-modal-actions`)\n*   **Authentication:** None Required (`nopriv` hook)\n*   **Preconditions:** An attacker must obtain a valid nonce for the `lps-modal-actions` action, which is often leaked on pages where the plugin's assets are enqueued.\n\n### 3. Code Flow\n1.  **Entry Point:** An unauthenticated user sends a POST request to `admin-ajax.php` with the action `lps_save_settings`.\n2.  **Hook Registration:** The plugin (in the main file, not provided) likely contains:\n    `add_action( 'wp_ajax_nopriv_lps_save_settings', [ $this, 'lps_save_settings' ] );`\n3.  **Nonce Verification:** The handler calls `check_ajax_referer( 'lps-modal-actions', 'verify' );`.\n4.  **Vulnerable Sink:** The handler proceeds to update options using `update_option()` based on the `settings` parameter without checking if the user has the `manage_options` capability.\n\n### 4. Nonce Acquisition Strategy\nThe nonce `lps-modal-actions` is generated in `incs\u002Fassets.php` inside the `use_script_modal()` function and localized into the `lpsGenVars` JavaScript object.\n\n*   **Localization Key:** `lpsGenVars`\n*   **Nonce Key:** `verify`\n*   **Strategy:**\n    1.  Create a page with the plugin's primary shortcode to trigger asset","The Latest Post Shortcode plugin for WordPress is vulnerable to unauthorized settings modification due to a missing capability check in an AJAX handler registered for unauthenticated users. This allows an attacker to obtain a valid nonce from the front-end and send a crafted request to modify the plugin's configuration settings.","\u002F\u002F incs\u002Fassets.php line 132\nfunction use_script_modal() {\n\tif ( ! \\wp_script_is( 'lps-admin-shortcode-button' ) ) {\n\t\t$lps = \\Latest_Post_Shortcode::get_instance();\n\n\t\t\\wp_register_script(\n\t\t\t'lps-admin-shortcode-button',\n\t\t\tLPS_PLUGIN_URL . 'assets\u002Fmodal.js',\n\t\t\t[ 'jquery' ],\n\t\t\tver(),\n\t\t\tfalse\n\t\t);\n\t\t\\wp_localize_script( 'lps-admin-shortcode-button', 'lpsGenVars', [\n\t\t\t'ajaxUrl'     => \\admin_url( 'admin-ajax.php' ),\n\t\t\t'verify'      => \\wp_create_nonce( 'lps-modal-actions' ),\n\t\t\t'icon'        => LPS_PLUGIN_URL . 'assets\u002Fimages\u002Ficon-purple.svg',\n\t\t\t'title'       => \\esc_html__( 'Latest Post Shortcode', 'lps' ),\n\t\t\t'outputTypes' => implode( ' ', array_filter( array_keys( $lps::get_card_output_types() ) ) ),\n\t\t\t'allowIcon'   => $lps::allow_icon_for_roles(),\n\t\t] );\n\t\t\\wp_enqueue_script( 'lps-admin-shortcode-button' );\n\t}\n}","diff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.1\u002Fchangelog.txt \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.2\u002Fchangelog.txt\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.1\u002Fchangelog.txt\t2026-01-18 08:59:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.2\u002Fchangelog.txt\t2026-02-09 19:40:46.000000000 +0000\n@@ -1,5 +1,12 @@\n == Changelog ==\n \n+= 14.2.1 =\n+* Tested up to 6.9\n+* Styles changes to allow for gradient as card background\n+* Fixed the mood toggle when the card background color changes\n+* Bundler output files with functions assigned to window (global variable)\n+* Fixed the cache reset vunerability\n+\n = 14.2.0 =\n * Tested up to 6.8.3\n * PHP 8.4 compatibility\ndiff -ru \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.1\u002Fincs\u002Fassets.php \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.2\u002Fincs\u002Fassets.php\n--- \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.1\u002Fincs\u002Fassets.php\t2026-01-18 08:59:32.000000000 +0000\n+++ \u002Fhome\u002Fdeploy\u002Fwp-safety.org\u002Fdata\u002Fplugin-versions\u002Flatest-post-shortcode\u002F14.2.2\u002Fincs\u002Fassets.php\t2026-02-09 19:40:46.000000000 +0000\n@@ -1,4 +1,4 @@\n-\u003C?php \u002F\u002Fphpcs:ignore Generic.Files.LineEndings.InvalidEOLChar\n+\u003C?php \u002F\u002F phpcs:disable Generic.Files.LineEndings.InvalidEOLChar\n \u002F**\n  * Latest Post Shortcode slider output.\n  * Text Domain: lps\n@@ -6,12 +6,13 @@\n  * @package lps\n  *\u002F\n \n+\u002F\u002F phpcs:disable WordPress.WP.I18n.TextDomainMismatch\n+\u002F\u002F phpcs:disable WordPress.NamingConventions.PrefixAllGlobals.NonPrefixedNamespaceFound\n+\n declare( strict_types = 1 );\n namespace LPS;\n \n-if ( ! defined( 'ABSPATH' ) ) {\n-\texit; \u002F\u002F Exit if accessed directly.\n-}\n+defined( 'ABSPATH' ) || exit;\n \n \\add_action( 'admin_enqueue_scripts', __NAMESPACE__ . '\\\\use_script_inline', 0 );\n \\add_action( 'wp_enqueue_scripts', __NAMESPACE__ . '\\\\use_script_inline', 0 );\n... (truncated at 18000 of 112549 chars — patch_diff)","The exploit targets an unauthenticated AJAX action that saves plugin settings. First, an attacker accesses any page where the plugin's modal assets are loaded to retrieve a valid nonce for the 'lps-modal-actions' action from the localized 'lpsGenVars' JavaScript object. Using this nonce, the attacker sends a POST request to '\u002Fwp-admin\u002Fadmin-ajax.php' with the 'action' parameter set to the settings-saving handler (likely 'lps_save_settings') and the 'verify' parameter containing the nonce. The payload includes a 'settings' parameter with malicious configuration data. Because the handler is registered with 'wp_ajax_nopriv_' and fails to verify the 'manage_options' capability, it processes the request and updates the plugin's global options.","gemini-3-flash-preview","2026-04-27 16:34:06","2026-04-27 16:34:55",{"type":42,"vulnerable_version":43,"fixed_version":11,"vulnerable_browse":44,"vulnerable_zip":45,"fixed_browse":46,"fixed_zip":47,"all_tags":48},"plugin","14.2.1","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatest-post-shortcode\u002Ftags\u002F14.2.1","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatest-post-shortcode.14.2.1.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatest-post-shortcode\u002Ftags\u002F14.2.2","https:\u002F\u002Fdownloads.wordpress.org\u002Fplugin\u002Flatest-post-shortcode.14.2.2.zip","https:\u002F\u002Fplugins.trac.wordpress.org\u002Fbrowser\u002Flatest-post-shortcode\u002Ftags"]