CVE-2026-114120: SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpspeleditorform AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Affected Software
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any authenticated user with the Contributor role can exploit it. The attacker can use the wpsp-el-editor nonce obtained from the Elementor modal.
What content can an attacker modify?
An attacker can change the status and publish date of any post. This includes unpublishing or rescheduling administrator posts and publishing posts belonging to other users that are pending or drafts.
Are installations running the fixed release affected?
The issue affects SchedulePress versions before 5.3.5. Updating to version 5.3.5 or later addresses the affected version range.