Critical Flaw in Smart Slider Plugin Puts 500K WordPress Sites at Risk

A security vulnerability has been identified in the Smart Slider 3 WordPress plugin, which is currently active on more than 800,000 websites. This flaw can be exploited by subscriber-level users to gain access to arbitrary files on the server.

If exploited, this vulnerability could allow an authenticated attacker to access critical files such as wp-config.php, which contains sensitive data like database credentials, keys, and salt information. This poses a significant risk of user data theft and potential website takeover.

Smart Slider 3 is a widely used WordPress plugin for creating and managing image sliders and content carousels. It offers a user-friendly drag-and-drop editor and a variety of templates to choose from.

The security flaw, identified as CVE-2026-3098, was brought to light by researcher Dmitrii Ignatyev and affects all versions of the Smart Slider 3 plugin up to version 3.5.1.33.

While the vulnerability has been rated with a medium severity score due to the requirement of authentication, it still poses a significant threat to websites with membership or subscription features, which are common among various platforms.

The root cause of the vulnerability lies in the absence of capability checks in the plugin’s AJAX export actions, allowing any authenticated user, including subscribers, to exploit them.

According to researchers at Defiant, the developer of the Wordfence security plugin, the ‘actionExportAll’ function in Smart Slider 3 lacks proper file type and source validation, enabling the reading and inclusion of arbitrary server files in the export archive.

Despite the presence of a nonce, the vulnerability remains exploitable as authenticated users can obtain it, as explained by István Márton, a vulnerability research contractor at Defiant.

Following the report by Ignatyev on February 23, Wordfence validated the exploit and notified Nextendweb, the developer of Smart Slider 3. Nextendweb acknowledged the issue on March 2 and released a patch on March 24 with the update to Smart Slider version 3.5.1.34.

500K websites still at risk

Despite the patch release, statistics from WordPress.org indicate that the plugin was downloaded over 303,428 times in the past week. This suggests that approximately 500,000 WordPress websites are still running a vulnerable version of Smart Slider 3, making them susceptible to potential attacks.

As of now, CVE-2026-3098 is not reported to be actively exploited. However, the situation could change rapidly, emphasizing the urgency for website owners and administrators to take immediate action to safeguard their websites.

Automated pentesting validates the existence of vulnerabilities, while BAS determines if your controls can prevent them. Many teams focus on one aspect without considering the other.

This whitepaper outlines six validation surfaces, identifies coverage limitations, and offers three key questions for evaluating any security tool effectively.

Get Your Copy Now