Live › vulnerability › CVE-2026-114120
Go to dashboardSchedulePress before 5.3.5 lets an authenticated Contributor change any post's status and publish date through the wpsp_el_editor_form AJAX action. An attacker can unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running SchedulePress before 5.3.5 that have Contributor-level accounts, including sites where users can register or be invited at that role. Sites without Contributor users or with the plugin already updated are not exposed by this flaw.
No product ranges from the sources yet.
wp plugin get schedulepress --field=versionwp user list --role=contributor5.3.5 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
This page as .md · .json · in your agent: get_signal("CVE-2026-114120")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.