{
 "id": "WPSEC-2026-2288",
 "url": "https://wpsec.com/vuln/WPSEC-2026-2288/",
 "json_url": "https://wpsec.com/vuln/WPSEC-2026-2288/advisory.json",
 "markdown_url": "https://wpsec.com/vuln/WPSEC-2026-2288/index.md",
 "title": "Simple Logo Carousel <= 1.9.6 - Authenticated (Editor+) Missing Authorization to Carousel and Logo Deletion",
 "description": "The Simple Logo Carousel plugin for WordPress is vulnerable to unauthorized deletion of carousels and logos in all versions up to, and including, 1.9.6, due to incomplete capability mappings on the slc_carousel and slc_logo custom post types. The delete capabilities (delete_posts, delete_others_posts, delete_published_posts and delete_private_posts) were not mapped to the plugin's own capabilities, so WordPress fell back to the core post capabilities when checking whether a user may delete an individual carousel or logo. This makes it possible for authenticated attackers with Editor-level access and above, who are not granted the plugin's carousel permissions, to delete carousels and logos through WordPress's core post deletion functionality, such as the XML-RPC wp.deletePost method.",
 "plugin": {
  "slug": "simple-logo-carousel",
  "name": "Simple Logo Carousel",
  "full_name": "Simple Logo Carousel",
  "wordpress_org": "https://wordpress.org/plugins/simple-logo-carousel/",
  "advisories_url": "https://wpsec.com/vuln/plugin/simple-logo-carousel/",
  "attacksurface": "https://attacksurface.wpsec.com/plugin/simple-logo-carousel"
 },
 "type": "NO AUTHORISATION",
 "cwe": [
  "CWE-862"
 ],
 "cve": [],
 "cvss": {
  "version": "3.1",
  "score": 3.8,
  "vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L",
  "severity": "Low"
 },
 "affected": {
  "ranges": [
   {
    "from": null,
    "from_inclusive": true,
    "to": "1.9.7",
    "to_inclusive": false
   }
  ],
  "text": [
   "all versions before 1.9.7"
  ]
 },
 "introduced_in": null,
 "fixed_in": "1.9.7",
 "remediation": "Update to 1.9.7 or later.",
 "fix_released": "2026-10-30T14:00:12+00:00",
 "published": "2026-11-03T14:48:33+00:00",
 "updated": "2026-11-03T13:23:37.090290+00:00",
 "also_published_as": null,
 "references": [
  "https://wpsec.com/vuln/WPSEC-2026-2288/",
  "https://plugins.svn.wordpress.org/simple-logo-carousel/tags/1.9.7/",
  "https://wordpress.org/plugins/simple-logo-carousel/"
 ],
 "attacksurface_url": "https://attacksurface.wpsec.com/plugin/simple-logo-carousel",
 "source": "WPSec",
 "license": {
  "name": "CC BY 4.0",
  "url": "https://creativecommons.org/licenses/by/4.0/"
 },
 "usage": {
  "plugin": "Low",
  "affected_versions": "Low",
  "as_of": "2026-11-03"
 }
}