Simple Logo Carousel <= 1.9.6 - Authenticated (Editor+) Missing Authorization to Carousel and Logo Deletion
- ID
- WPSEC-2026-2288
- Plugin
- Simple Logo Carousel (simple-logo-carousel)
- Affected
- all versions before 1.9.7
- Remediation
- Update to 1.9.7 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-03
- Attack surface
- Simple Logo Carousel on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Logo Carousel plugin for WordPress is vulnerable to unauthorized deletion of carousels and logos in all versions up to, and including, 1.9.6, due to incomplete capability mappings on the slc_carousel and slc_logo custom post types. The delete capabilities (delete_posts, delete_others_posts, delete_published_posts and delete_private_posts) were not mapped to the plugin's own capabilities, so WordPress fell back to the core post capabilities when checking whether a user may delete an individual carousel or logo. This makes it possible for authenticated attackers with Editor-level access and above, who are not granted the plugin's carousel permissions, to delete carousels and logos through WordPress's core post deletion functionality, such as the XML-RPC wp.deletePost method.
References
- https://wpsec.com/vuln/WPSEC-2026-2288/
- https://plugins.svn.wordpress.org/simple-logo-carousel/tags/1.9.7/
- https://wordpress.org/plugins/simple-logo-carousel/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS