CVE-2026-114120

EUVD-2026-107232
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
5.4 MEDIUM
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
Awaiting analysis
This vulnerability is currently awaiting analysis.
Base Score
CVSS 3.x
EPSS Score
Percentile: Unknown
Common Weakness Enumeration
References
https://github.com/WPDevelopers/wp-scheduled-posts/blob/v5.3.4/includes/Admin.php#L1276-L1521
https://github.com/WPDevelopers/wp-scheduled-posts/commit/0e7af0fcbf0851687c34db2997117032978dbe06
https://wordpress.org/plugins/wp-scheduled-posts/
https://www.vulncheck.com/advisories/schedulepress-before-5.3.5-missing-authorization-via-wpsp-el-editor-form-ajax-action