The SchedulePress – Auto Post & Publish, Auto Social Share, Schedule Posts with Editorial Calendar & Missed Schedule Post Publisher WordPress plugin contains a full path disclosure vulnerability in all versions up to 5.1.3. This occurs because the plugin uses the wpdeveloper library and leaves demo files with display_errors enabled, allowing unauthenticated attackers to retrieve the full filesystem path of the web application. While the disclosed information alone is not sufficient to cause damage, it can facilitate other attacks if additional vulnerabilities exist on the affected site.

The vulnerability exposes the full path of the web application to unauthenticated users, which is classified as an information disclosure issue (CWE-200). This exposure has limited direct impact but can assist attackers in crafting further attacks by revealing server directory structure. There is no direct impact on data confidentiality, integrity, or availability from this vulnerability alone. No known exploits have been reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling display_errors in their PHP configuration and removing any demo or example files included with the plugin to reduce information leakage. Monitor the vendor's communications for updates and apply patches promptly when released.