CVE-2026-114120
Medium
Description
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
SeverityMedium
CVSS5.4
Exploit probability—
ProductSchedulePress
PublishedOct 21, 2026
First seenOct 21, 2026
Weakness typeCWE-862Missing authorization
How to fix
Update
- WPDeveloper SchedulePress5.3.5 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| WPDeveloper SchedulePress | v < 5.3.5 | 5.3.5 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.