Logo Slider <= 5.5.5 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Post Order Modification
- ID
- WPSEC-2026-0315
- Plugin
- Logo Slider WP – Responsive Logo Carousel, Logo Gallery & Logo Showcase (logo-slider-wp)
- Affected
- from 2.3.4 before 6.0.0
- Remediation
- Update to 6.0.0 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
- Weakness
- CWE-862
- Usage
- Plugin Low · Affected versions Low among sites WPSec scans, 2026-10-22
- Attack surface
- Logo Slider on WPSec AttackSurface
- Fix released
- Published
Description
The Logo Slider plugin for WordPress is vulnerable to unauthorized modification of data in versions 2.3.4 up to, and including, 5.5.5. The wp_ajax_lgx_ls_admin_lswp_reorder AJAX action (save_post_reorder_for_logosliderwp) has no capability check, and a failed nonce check only sets an error message without stopping execution. This makes it possible for authenticated attackers, with Subscriber-level access and above, to change the menu_order value of arbitrary posts on the site (for example pages, navigation menu items or products), which changes the order in which that content is listed. The same flaw also leaves the action open to cross-site request forgery.
References
- https://wpsec.com/vuln/WPSEC-2026-0315/
- https://plugins.svn.wordpress.org/logo-slider-wp/tags/6.0.0/
- https://wordpress.org/plugins/logo-slider-wp/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS