CVE-2026-114120 in SchedulePress Plugin
Summary
by MITRE • 10/21/2026
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/21/2026
The vulnerability identified in SchedulePress prior to version 5.3.5 represents a critical failure in access control mechanisms within the WordPress ecosystem. Specifically, this is an insecure direct object reference combined with broken function level authorization issue that allows authenticated users with low-privilege roles, such as Contributors, to perform administrative actions intended for higher-level roles like Administrators or Editors. The core of the flaw lies in the handling of the wpsp_el_editor_form AJAX action endpoint. This endpoint is designed to manage post scheduling and editing features but fails to adequately verify whether the requesting user possesses the necessary permissions to modify specific posts, particularly those owned by other users or designated as high-privilege content.
From a technical perspective, the exploitation vector relies on the reuse of nonces associated with Elementor modals. In WordPress security architecture, Nonces are used to prevent Cross-Site Request Forgery attacks and ensure that requests originate from legitimate sources within the application context. However, in this scenario, the nonce validation is either insufficiently scoped or incorrectly implemented such that it does not bind strictly enough to the specific user capabilities required for post status modification. An attacker with Contributor access can intercept or construct a request using the wpsp-el-editor nonce obtained from an Elementor interface interaction. By manipulating parameters within this AJAX call, the attacker can specify arbitrary post IDs and alter their publication status or scheduled dates without triggering appropriate permission checks that would normally block such actions for lower-privileged users.
The operational impact of this vulnerability is significant due to its potential for data integrity compromise and workflow disruption. Attackers can unpublish posts created by administrators, effectively removing critical content from the public view and causing service availability issues or reputational damage depending on the nature of the site. Furthermore, attackers can reschedule administrator posts to future dates, potentially delaying important announcements or updates. A more severe consequence involves the ability to publish pending or draft posts belonging to other users. This allows an attacker to bypass editorial workflows, forcing content into public view without proper review or approval from editors and administrators. This undermines the fundamental trust model of multi-author WordPress sites where role-based access control is essential for maintaining content quality and security.
This vulnerability aligns with CWE-269, which classifies Improper Privilege Management, as it involves a user gaining privileges they are not authorized to have. It also relates closely to CWE-862, Missing Authorization, because the application fails to enforce access control policies on specific resources or actions. In terms of offensive security frameworks, this behavior maps to MITRE ATT&CK technique T1078, Valid Accounts, where an attacker uses legitimate credentials but exploits a flaw in how those accounts are permitted to interact with system functions. The exploitation does not require complex buffer overflows or code injection; rather, it leverages the inherent trust placed in authenticated sessions and poorly validated AJAX endpoints common in many WordPress plugins that integrate with page builders like Elementor.
Mitigation strategies must focus on immediate patching and rigorous access control validation. Site administrators should upgrade SchedulePress to version 5.3.5 or later immediately, as this release addresses the authorization checks within the wpsp_el_editor_form action. For environments where upgrading is not instantly feasible, temporary mitigations include restricting AJAX endpoint access via web application firewall rules that limit POST requests from low-privilege user agents if possible, although this may impact legitimate functionality. Additionally, implementing strict role-based permissions at the plugin configuration level can help minimize exposure. Developers should ensure that all AJAX handlers perform capability checks using WordPress functions like current_user_can before processing any state-changing operations on post objects. Regular security audits of custom code and third-party plugins are essential to identify similar authorization flaws in other parts of the application stack, ensuring that privilege escalation vectors remain closed across the entire system.