Read the docs
TI-2026-78765 Aliases CVE-2026-114120GHSA-wjcc-2q8h-xjfx

Missing authorization in SchedulePress lets contributors change post status

Priority LOW 24CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · Low · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

SchedulePress before 5.3.5 contains a missing authorization flaw (CWE-862) that lets authenticated Contributor-level users change the status and publish date of any post through the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00286 21st percentileScored 2026-11-07
Fix Fixed SchedulePress (WPDeveloper): 5.3.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
wpdevteamSchedulePressbefore 5.3.55.3.5Patch availableCNA
  • SchedulePress Vendorwpdevteam Affected before 5.3.5 Fixed in 5.3.5 Patch available CNA

Remediation

Update SchedulePress to version 5.3.5 or later, which fixes the vulnerability.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

  • Fix · CNA SchedulePress (WPDeveloper) Fixed in 5.3.5

Timeline

  1. 2026-10-21 Threatist record created from CVE-2026-114120
  2. 2026-10-21 CISA SSVC decision points changed
  3. 2026-10-21 Alias added: GHSA-wjcc-2q8h-xjfx

References

Patch 1

Other 2

  • TI-2024-01579 SQL injection in wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce… CVSS 3.1CRITICAL 9.8
  • TI-2023-15541 WordPress Essential Addons for Elementor Plugin 5.4.0-5.7.1 is vulnerable to Privilege Escalation CVSS 3.1CRITICAL 9.8
  • TI-2023-06070 Essential Blocks < 4.4.3 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
  • TI-2023-11478 SQL injection in ReviewX WordPress Plugin CVSS 3.1HIGH 8.8
  • TI-2022-00275 NotificationX < 2.3.9 - Unauthenticated Blind SQL Injection CVSS 3.1CRITICAL 9.8
  • TI-2024-05197 Essential Blocks < 4.7.0 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
See all 209 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences