A severe security flaw has been disclosed in Smart Slider 3, a highly popular WordPress plugin currently active on more than 800,000 websites.
Discovered by security researcher Dmitrii Ignatyev, this vulnerability enables authenticated attackers to read arbitrary files directly from the hosting server.
If exploited, the flaw exposes critical backend infrastructure to unauthorized users.
The root cause of this vulnerability lies deep within the plugin’s export architecture.
Smart Slider 3 utilizes a series of AJAX actions to facilitate the exporting of slider data.
Although the plugin developers correctly implemented a nonce token to protect the primary export action, they neglected to enforce strict capability checks.
Because the nonce is accessible to any authenticated user, low-privileged accounts like basic subscribers can easily obtain it and invoke the AJAX request.
During execution, the plugin relies on the actionExportAll() function within the ControllerSliders class to manage the final download of the export file.
This process calls the create() method inside the ExportSlider class, which compresses the targeted data into a ZIP archive.
Unfortunately, the vulnerable versions entirely lack file type validation during this packaging phase.
As a result, the plugin blindly processes and packages system files, including .php scripts, instead of restricting exports solely to multimedia files.
By weaponizing the lack of permission checks in the actionExportAll function, a malicious actor can manipulate the export routine to target sensitive system files.
This vulnerability allows an attacker with mere subscriber access to quietly extract critical configuration data.
The primary target during such an attack is typically the wp-config.php file.
Reading this specific file provides the attacker with plaintext database credentials, secret authentication keys, and cryptographic salts.
Armed with this sensitive information, threat actors can escalate their privileges, manipulate database records, or achieve a complete website takeover.
Ignatyev responsibly disclosed the vulnerability on February 23, 2026, earning a $2,208 bounty through a bug hunting program.
Following validation, protective firewall rules were deployed for premium security customers the next day.
The plugin developer, Nextend, acknowledged the report and promptly released version 3.5.1.34 on March 24, 2026, to fully resolve the missing capability checks.
Website administrators must urgently verify their plugin library and update Smart Slider 3 to version 3.5.1.34 to prevent unauthorized data access.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…