WordPress Plugin Vulnerabilities

SchedulePress < 5.0.5 - Contributor+ Arbitrary Post Update/Deletion

Description

The plugin does not have proper capability checks on several REST API endpoints, allowing contributors and above roles to edit and delete arbitrary posts

Affects Plugins

Plugin icon
wp-scheduled-posts
Fixed in 5.0.5

References

URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/cd2c9b28-d5b5-4930-a441-f889ee2778cd

Classification

Type
INCORRECT AUTHORISATION
OWASP top 10
A5: Broken Access Control
CWE
CWE-863
CVSS
2.7 (low)

Miscellaneous

Verified
No
WPVDB ID
3b934aac-12b6-4290-ba0e-ed741d53ec57

Timeline

Publicly Published
2023-11-28 (about 2 years ago)
Added
2024-01-29 (about 2 years ago)
Last Updated
2024-01-29 (about 2 years ago)

Other

Published
Title
Published
2025-06-16
Title
Poll, Survey & Quiz Maker Plugin by Opinion Stage < 19.10.0 - Incorrect Authorization to Authenticated (Contributor+) Plugin Settings Update
Published
2023-12-14
Title
Sensei LMS < 4.20.0 - Teacher+ Users Email Address Disclosure
Published
2026-01-06
Title
Rankology SEO and Analytics Tool <= 2.0 - Editor+ Header & Footer Code Creation
Published
2023-11-21
Title
Abandoned Cart Lite for WooCommerce < 5.16.1 - Improper Authorization via wcal_preview_emails
Published
2023-11-29
Title
Download Manager < 3.2.83 - Unauthenticated Protected File Download Password Leak