Description
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
WPDeveloper SchedulePress
Default version status: unaffected
0 to < 5.3.5affected
References
- https://github.com/WPDevelopers/wp-scheduled-posts/commit/0e7af0fcbf0851687c34db2997117032978dbe06 ↗
- https://github.com/WPDevelopers/wp-scheduled-posts/blob/v5.3.4/includes/Admin.php#L1276-L1521 ↗
- https://wordpress.org/plugins/wp-scheduled-posts/ ↗
- https://www.vulncheck.com/advisories/schedulepress-before-5.3.5-missing-authorization-via-wpsp-el-editor-form-ajax-action ↗