SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal
- ID
- WPSEC-2026-1249
- Plugin
- SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher (wp-scheduled-posts)
- Affected
- all versions before 5.3.5
- Remediation
- Update to 5.3.5 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions None seen among sites WPSec scans, 2026-10-19
- Attack surface
- SchedulePress on WPSec AttackSurface
- Fix released
- Published
Description
The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to unauthorized modification of data via the Elementor schedule modal (wpsp_el_editor_form AJAX action) in all versions up to, and including, 5.3.4, due to a missing capability check in the wpsp_el_tab_action function, which only verifies a nonce that is not tied to a specific post. This makes it possible for authenticated attackers with Contributor-level access and above who can open the Elementor editor to change the date and status of arbitrary posts by ID, including other users' posts, for example publishing, scheduling, unpublishing or trashing them.
References
- https://wpsec.com/vuln/WPSEC-2026-1249/
- https://plugins.svn.wordpress.org/wp-scheduled-posts/tags/5.3.5/
- https://wordpress.org/plugins/wp-scheduled-posts/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS