This vulnerability (CWE-862) in WPDeveloper SchedulePress involves missing authorization checks, allowing users with some level of privilege to bypass intended access controls. It affects SchedulePress versions up to 5.0.8. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, required privileges, no user interaction, unchanged scope, high confidentiality impact, and no integrity or availability impact. No vendor advisory or patch information is currently available, and no exploits have been reported in the wild.

An attacker with limited privileges could exploit this vulnerability to gain unauthorized access to sensitive information within the SchedulePress plugin. The confidentiality of data may be compromised, but integrity and availability are not affected. Since no known exploits exist in the wild, the immediate risk is moderate but could increase if exploitation techniques are developed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the SchedulePress plugin to trusted users only and monitor for unusual activity related to plugin usage. Avoid granting unnecessary privileges that could be leveraged to exploit this vulnerability.