Aller au contenu
Se connecter
5.3 Moyenne

CVE-2026-114120 SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level…

Description

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Produits et versions touchés

Produit Versions touchées Corrigé en
SchedulePress 5.3 premières → < 5.3.5 5.3.5

Autres CVE de SchedulePress

Les 3 CVE de SchedulePress →
CVE-2024-6557 The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule… 5.3 Moyenne CVE-2024-32717 Missing Authorization vulnerability in WPDeveloper SchedulePress.This issue affects SchedulePress: from n/a through… 6.5 Moyenne
Suivre cette CVE