SchedulePress CVE-2026-114120

Requires an authenticated Contributor-level account (PR:L) on a site running SchedulePress / WP Scheduled Posts before 5.3.5, plus a valid wpsp-el-editor nonce that the attacker obtains from the Elementor editor modal they can legitimately open. The vulnerable path is the wpsp_el_editor_form AJAX action (and related PostPanel REST routes), which checked only edit_post and not publish_post. Limiting factors: exploitation is impossible without a provisioned low-privilege account, so closed single-author sites are not realistically at risk; impact is bounded to post status/schedule manipulation of other users' content with no data disclosure, and the nonce dependency means the attacker needs editor-modal access rather than a fully pre-authentication path.

This is a genuine but moderate-severity access-control flaw, not a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L) and 5.3 Medium score are internally consistent with the description: exploitation is network-reachable and low-complexity, but requires an authenticated Contributor-level account (PR:L), which is the single biggest limiting factor. Impact is confined to integrity and availability of post publishing state (VI:L/VA:L) with no confidentiality exposure (VC:N) - an attacker cannot read protected data, only unpublish/reschedule others' posts or publish others' drafts. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation; this points to a low real-world exploitation likelihood absent a site where untrusted users hold Contributor accounts. SSVC-style framing: exploitation=none observed, automatable=yes in principle (single authenticated AJAX call), technical impact=partial. Net: prioritize patching on multi-author/membership sites that provision Contributor accounts to untrusted users; it is lower urgency on single-author or closed-editorial sites. One caveat: no EPSS/KEV/POC data was supplied, so exploitation probability is inferred from the vector and description rather than measured - treat the 'low likelihood' judgment as an inference, not a confirmed signal.

On a multi-author WordPress site, a user holding only a Contributor account opens the Elementor editor modal to harvest the valid wpsp-el-editor nonce, then replays it in a crafted wpsp_el_editor_form AJAX request specifying an administrator's post ID. The missing authorization check lets them unpublish or reschedule that administrator post, or flip another user's pending/draft post to published. No public exploit code is identified at time of analysis, but the attack is trivial to script once a Contributor account is held.