# SchedulePress <= 5.3.4 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Publishing and Status Change via Elementor Schedule Modal

- **ID:** WPSEC-2026-1249
- **Plugin:** SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher (`wp-scheduled-posts`), https://wordpress.org/plugins/wp-scheduled-posts/
- **Affected versions:** all versions before 5.3.5
- **Fixed in:** 5.3.5 (Update to 5.3.5 or later.)
- **Severity:** Medium 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions None seen (as of 2026-10-19)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/wp-scheduled-posts
- **Fix released:** 2026-10-18
- **Published:** 2026-10-19
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1249/

## Description

The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher plugin for WordPress is vulnerable to unauthorized modification of data via the Elementor schedule modal (wpsp_el_editor_form AJAX action) in all versions up to, and including, 5.3.4, due to a missing capability check in the wpsp_el_tab_action function, which only verifies a nonce that is not tied to a specific post. This makes it possible for authenticated attackers with Contributor-level access and above who can open the Elementor editor to change the date and status of arbitrary posts by ID, including other users' posts, for example publishing, scheduling, unpublishing or trashing them.

## References

- https://wpsec.com/vuln/WPSEC-2026-1249/
- https://plugins.svn.wordpress.org/wp-scheduled-posts/tags/5.3.5/
- https://wordpress.org/plugins/wp-scheduled-posts/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1249/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.