cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Smart Slider 3 Flaw Exposes Server Files on Vulnerable WordPress Sites

· Original article ↗

Summary

CVE-2026-3098 lets authenticated subscriber-level users read arbitrary server files through Smart Slider 3’s AJAX export function. Version 3.5.1.34 fixes the flaw; the article estimates about 500,000 sites remain vulnerable.

Key points

  • CVE-2026-3098 affects Smart Slider 3 versions through 3.5.1.33.
  • Authenticated users, including subscribers, can invoke vulnerable AJAX export actions because of missing capability checks.
  • The actionExportAll function lacks file-type and source validation, allowing sensitive files such as wp-config.php to be included in an export.
  • Access to wp-config.php could expose database credentials, keys, and salts, creating risks of data theft and site takeover.
  • Nextendweb released a fix in version 3.5.1.34 on March 24 after Wordfence validated the reported proof of concept.
  • The article estimates roughly 500,000 sites remain on vulnerable versions and says the flaw was not flagged as actively exploited at the time of writing.

Article Details

Vulnerability Types
  • Authenticated arbitrary file read
Severity
Medium
Affected Versions
  • Smart Slider 3 versions through 3.5.1.33
Exploitation Status
not_reported
Exploit Availability
claimed_or_private
Patch Status
available

MITRE ATT&CK

T1005 · Data from Local SystemThe flaw could let an authenticated subscriber read arbitrary files from the server, including wp-config.php.

CVE

CVE-2026-3098nextendweb · Smart Slider 3Tracked as CVE-2026-3098 and fixed in version 3.5.1.34, the flaw stems from missing capability and file-type checks in AJAX export actions and leaves roughly 500,000 sites still running vulnerable versions that should

People

Dmitrii IgnatyevDiscovered the vulnerability and reported it to Wordfence.István MártonA vulnerability research contractor at Defiant who described how the missing file-type and source checks enable arbitrary file reads.

Vendors

NextendwebNextendweb released a patch in 3.5.1.34 on March 24, but approximately 500,000 sites remain vulnerable and should apply the update immediately.

Products

Smart Slider 3A vulnerability in the Smart Slider 3 WordPress plugin, installed on over 800,000 sites, allows authenticated subscriber-level users to read arbitrary server files—including wp-config.php—putting database credentials,WordfenceAccording to researchers at WordPress security company Defiant, the developer of the Wordfence security plugin, the ‘actionExportAll’ function lacks file type and source validation, thus allowing arbitrary server filesWordPressA vulnerability in the Smart Slider 3 WordPress plugin, installed on over 800,000 sites, allows authenticated subscriber-level users to read arbitrary server files—including wp-config.php—putting database credentials,

Related Articles