CVE-2026-114120: falha de média gravidade em WPDeveloper SchedulePress
SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action
Publicada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.3epss 0.3%
SchedulePress before 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse the wpsp-el-editor nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N
Produtos afetados
WPDeveloper · SchedulePressCVEs relacionadas — WPDeveloper SchedulePress
No mesmo produto, das mais perigosas para as menos.
Referências
https://github.com/WPDevelopers/wp-scheduled-posts/blob/v5.3.4/includes/Admin.php#L1276-L1521https://github.com/WPDevelopers/wp-scheduled-posts/commit/0e7af0fcbf0851687c34db2997117032978dbe06https://wordpress.org/plugins/wp-scheduled-posts/https://www.vulncheck.com/advisories/schedulepress-before-5.3.5-missing-authorization-via-wpsp-el-editor-form-ajax-action