CVE-2026-114120 WPDeveloper CVE debrief

Who should care

Defenders responsible for WordPress installations with the SchedulePress plugin should assess exposure and prioritize patching to prevent potential unauthorized post status changes and publish date modifications.

Why it matters

Defenders should prioritize verifying and applying the patch (version 5.3.5 or later) for SchedulePress to prevent potential unauthorized post status changes and publish date modifications by authenticated Contributor-level users.

• Potential unauthorized post status changes by authenticated Contributor-level users
• Potential modifications to publish dates by authenticated Contributor-level users
• Verification of patch application to prevent exploitation
• Monitoring for suspicious post status changes and publish date modifications

Technical summary

SchedulePress before version 5.3.5 contains a missing authorization vulnerability that allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. The vulnerability arises from inadequate authorization checks in the wpsp_el_editor_form AJAX action, which can be exploited by authenticated Contributor-level users to modify post status and publish dates without proper authorization. This can lead to unauthorized changes to post status and publish dates, potentially disrupting content management and publication workflows.

Defensive priority

Defenders should prioritize verifying and applying the patch (version 5.3.5 or later) for SchedulePress to prevent potential unauthorized post status changes and publish date modifications.

Recommended defensive actions

• Verify and apply the patch (version 5.3.5 or later) for SchedulePress
• Restrict access to the wpsp_el_editor_form AJAX action
• Monitor for suspicious post status changes and publish date modifications
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the missing authorization vulnerability in SchedulePress before version 5.3.5, which allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.