Skip to content
Sign in
5.3 Medium

CVE-2026-114120 SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level…

Description

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Affected products and versions

Product Affected versions Fixed in
SchedulePress 5.3 earliest → < 5.3.5 5.3.5

Other CVEs of SchedulePress

The 3 CVEs of SchedulePress →
CVE-2024-6557 The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule… 5.3 Medium CVE-2024-32717 Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through… 6.5 Medium
Track this CVE