# Logo Slider <= 6.2.0 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Status Change via Bulk Actions

- **ID:** WPSEC-2026-3048
- **Plugin:** Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase (`logo-slider-wp`), https://wordpress.org/plugins/logo-slider-wp/
- **Affected versions:** from 6.0.0 before 6.2.1
- **Fixed in:** 6.2.1 (Update to 6.2.1 or later.)
- **Severity:** Medium 4.3 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N)
- **Weakness:** CWE-862
- **Usage among sites WPSec scans:** plugin Low, affected versions Low (as of 2026-11-13)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/logo-slider-wp
- **Fix released:** 2026-11-12
- **Published:** 2026-11-13
- **URL:** https://wpsec.com/vuln/WPSEC-2026-3048/

## Description

The Logo Slider WP plugin for WordPress is vulnerable to unauthorized modification of data via the Publish, Set to Draft, Duplicate and Assign Category bulk actions of the Logo list in versions 6.0.0 up to, and including, 6.2.0, due to a missing per-post capability check and a missing post type check in the handle_bulk_actions() function. The handler passes every submitted post ID to wp_update_post() or wp_set_object_terms() without checking that the user may edit or publish that post, or that it is a logo. This makes it possible for authenticated attackers, with Contributor-level access and above, to publish their own pending content without review, publish or unpublish (set to draft) any post or page on the site, including those of other users, duplicate other users' logos, and assign logo categories to posts they cannot edit.

## References

- https://wpsec.com/vuln/WPSEC-2026-3048/
- https://plugins.svn.wordpress.org/logo-slider-wp/tags/6.2.1/
- https://wordpress.org/plugins/logo-slider-wp/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-3048/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.