Schedulepress
Monthly
Missing authorization in the SchedulePress (WP Scheduled Posts) WordPress plugin before 5.3.5 allows authenticated Contributor-level users to alter the status and publish date of posts they do not own, including unpublishing or rescheduling administrator content and pushing other users' pending or draft posts live. The root cause is that the wpsp_el_editor_form AJAX handler and the related PostPanel REST routes validated only the edit_post capability - which a Contributor already holds for their own drafts - instead of publish_post, and the wpsp-el-editor nonce is not bound to a specific post, so it can be reused against any post ID. Exploitation requires a provisioned low-privilege account and access to the Elementor editor modal from which the nonce is harvested; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, with impact bounded to integrity/availability of post scheduling and no data disclosure. The vendor has released 5.3.5 to address the flaw.
Missing authorization in the SchedulePress (WP Scheduled Posts) WordPress plugin before 5.3.5 allows authenticated Contributor-level users to alter the status and publish date of posts they do not own, including unpublishing or rescheduling administrator content and pushing other users' pending or draft posts live. The root cause is that the wpsp_el_editor_form AJAX handler and the related PostPanel REST routes validated only the edit_post capability - which a Contributor already holds for their own drafts - instead of publish_post, and the wpsp-el-editor nonce is not bound to a specific post, so it can be reused against any post ID. Exploitation requires a provisioned low-privilege account and access to the Elementor editor modal from which the nonce is harvested; no public exploit code has been identified at time of analysis and the issue is not listed in CISA KEV, with impact bounded to integrity/availability of post scheduling and no data disclosure. The vendor has released 5.3.5 to address the flaw.