# Simple Logo Carousel <= 1.9.6 - Authenticated (Editor+) Missing Authorization to Carousel and Logo Deletion

- **ID:** WPSEC-2026-2288
- **Plugin:** Simple Logo Carousel (`simple-logo-carousel`), https://wordpress.org/plugins/simple-logo-carousel/
- **Affected versions:** all versions before 1.9.7
- **Fixed in:** 1.9.7 (Update to 1.9.7 or later.)
- **Severity:** Low 3.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:L)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-03)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-logo-carousel
- **Fix released:** 2026-10-30
- **Published:** 2026-11-03
- **URL:** https://wpsec.com/vuln/WPSEC-2026-2288/

## Description

The Simple Logo Carousel plugin for WordPress is vulnerable to unauthorized deletion of carousels and logos in all versions up to, and including, 1.9.6, due to incomplete capability mappings on the slc_carousel and slc_logo custom post types. The delete capabilities (delete_posts, delete_others_posts, delete_published_posts and delete_private_posts) were not mapped to the plugin's own capabilities, so WordPress fell back to the core post capabilities when checking whether a user may delete an individual carousel or logo. This makes it possible for authenticated attackers with Editor-level access and above, who are not granted the plugin's carousel permissions, to delete carousels and logos through WordPress's core post deletion functionality, such as the XML-RPC wp.deletePost method.

## References

- https://wpsec.com/vuln/WPSEC-2026-2288/
- https://plugins.svn.wordpress.org/simple-logo-carousel/tags/1.9.7/
- https://wordpress.org/plugins/simple-logo-carousel/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-2288/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.