SchedulePress Missing Authorization Lets Contributors Modify Posts

Executive Summary

This vulnerability is a missing authorization issue in SchedulePress before version 5.3.5. It allows authenticated Contributor-level users to change any post's status and publish date via the wpsp_el_editor_form AJAX action. Attackers can reuse a nonce from the Elementor modal to unpublish or reschedule administrator posts, or publish other users' pending or draft posts.

Useful 0 Not Useful 0

Detection Guidance

Check if your SchedulePress plugin version is below 5.3.5. Inspect server logs for unauthorized AJAX requests to wpsp_el_editor_form. Review user activity logs for Contributor-level users modifying post statuses or publish dates.

Useful 0 Not Useful 0

Impact Analysis

If exploited, this vulnerability could allow unauthorized users to modify post statuses and publishing dates. This could disrupt content schedules, unpublish important posts, or publish drafts prematurely. It may also lead to unauthorized content being shared or misinformation being spread if posts are altered without approval.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows unauthorized users to modify post statuses and publish dates, which could lead to unauthorized changes to sensitive content. For GDPR, this may violate integrity and confidentiality principles if personal data is altered without permission. For HIPAA, unauthorized post modifications could compromise protected health information integrity if such data is involved.

Useful 0 Not Useful 0

Mitigation Strategies

Update SchedulePress to version 5.3.5 or later immediately. Remove or restrict Contributor-level user permissions if they are not required. Monitor for any unauthorized post modifications and audit user roles.

Useful 0 Not Useful 0