{
 "id": "WPSEC-2026-1249",
 "url": "https://wpsec.com/vuln/WPSEC-2026-1249/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-1249/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-1249/index.md",
 "title": "SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal",
 "description": "The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to unauthorized modification of data via the Elementor schedule modal (wpsp_el_editor_form AJAX action) in all versions up to, and including, 5.3.4, due to a missing capability check in the wpsp_el_tab_action function, which only verifies a nonce that is not tied to a specific post. This makes it possible for authenticated attackers with Contributor-level access and above who can open the Elementor editor to change the date and status of arbitrary posts by ID, including other users' posts, for example publishing, scheduling, unpublishing or trashing them.",
 "plugin": {
  "slug": "wp-scheduled-posts",
  "name": "SchedulePress",
  "full_name": "SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher",
  "wordpress_org": "https://wordpress.org/plugins/wp-scheduled-posts/",
  "advisories_url": "https://wpsec.com/vuln/plugin/wp-scheduled-posts/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/wp-scheduled-posts"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 5.4,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Medium"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "5.3.5",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 5.3.5"
  ]
 },
 "introduced_in": null,
 "fixed_in": "5.3.5",
 "remediation": "Update to 5.3.5 or later.",
 "fix_released": "2026-10-18T08:36:54+00:00",
 "published": "2026-10-19T08:48:41+00:00",
 "updated": "2026-10-18T10:55:38.974157+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-1249/",
  "https://plugins.svn.wordpress.org/wp-scheduled-posts/tags/5.3.5/",
  "https://wordpress.org/plugins/wp-scheduled-posts/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/wp-scheduled-posts",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "None seen",
  "as_of": "2026-10-19"
 }
}