Logo Slider <= 6.2.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Status Change via Bulk Actions
- ID
- WPSEC-2026-3048
- Plugin
- Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase (logo-slider-wp)
- Affected
- from 6.0.0 before 6.2.1
- Remediation
- Update to 6.2.1 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-11-13
- Attack surface
- Logo Slider on WPSec AttackSurface
- Fix released
- Published
Description
The Logo Slider WP plugin for WordPress is vulnerable to unauthorized modification of data via the Publish, Set to Draft, Duplicate and Assign Category bulk actions of the Logo list in versions 6.0.0 up to, and including, 6.2.0, due to a missing per-post capability check and a missing post type check in the handle_bulk_actions() function. The handler passes every submitted post ID to wp_update_post() or wp_set_object_terms() without checking that the user may edit or publish that post, or that it is a logo. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish their own pending content without review, publish or unpublish (set to draft) any post or page on the site, including those of other users, duplicate other users' logos, and assign logo categories to posts they cannot edit.
References
- https://wpsec.com/vuln/WPSEC-2026-3048/
- https://plugins.svn.wordpress.org/logo-slider-wp/tags/6.2.1/
- https://wordpress.org/plugins/logo-slider-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS