SchedulePress prior to version 5.3.5 allows an authenticated Contributor-level user to modify any post’s status and scheduled publication date through the wpsp_el_editor_form AJAX action, in violation of CMS role permissions. The flaw is a missing authorization check (CWE-862). An attacker could unpublish or reschedule administrator posts, or publish other users’ pending or draft content, thereby compromising the integrity of the site’s published material.

The vulnerability affects the WPDeveloper SchedulePress plugin on all installations using a version earlier than 5.3.5. No other vendors or products are mentioned.

The CVSS score is 5.3, indicating a medium severity. EPSS data is not available, and the issue is not listed in the CISA KEV catalog. Attackers need the ability to authenticate as a Contributor and to reuse a valid wpsp‑el‑editor nonce derived from the Elementor modal. Once authenticated, alteration of post metadata is straightforward through the exposed AJAX endpoint, making the flaw exploitable in any WordPress environment running the affected plugin.