Critical WordPress Plugin Bug Exposes 800K+ Sites’ Sensitive Data

Key Takeaways

• A critical arbitrary file read vulnerability (CVE-2026-3098) has been discovered in Smart Slider 3, a popular WordPress plugin.
• Over 800,000 WordPress websites are at risk of having sensitive configuration files, including wp-config.php, exposed.
• Attackers with even basic subscriber-level authentication can exploit this flaw to download critical server files.
• A patch is available in Smart Slider 3 version 3.5.1.34, and all users are urged to update immediately.

A significant security vulnerability has been identified in Smart Slider 3, a widely used WordPress plugin for creating responsive sliders. This flaw, affecting more than 800,000 active installations, could allow attackers to steal highly sensitive data from compromised websites.

The vulnerability, tracked as CVE-2026-3098, is classified as a medium-severity issue but poses a high risk due to its potential impact. It enables authenticated attackers, even those with minimal user privileges, to download critical configuration files directly from the hosting server.

This exposure is particularly concerning for websites that permit public user registration, as any standard subscriber account could be leveraged to initiate an attack.

Deep Dive into the Vulnerability

The core of this vulnerability, an Authenticated Arbitrary File Read, lies within the plugin’s export functionality. Specifically, the flaw exists within the actionExportAll() function inside the ControllerSliders class.

Typically, the plugin’s export process involves multiple AJAX requests to compile and download a ZIP archive containing slider images and configuration settings. While one of these crucial actions is protected by a security nonce, researchers found that authenticated attackers could easily obtain this token in vulnerable versions of the plugin.

A critical oversight is the absence of proper capability checks in the AJAX functions, which fail to verify a user’s role before executing the export code. This lapse allows any authenticated user, regardless of their privilege level, to trigger the export action without requiring administrative access.

Furthermore, the create() function, responsible for building the export ZIP file, does not adequately validate the source or type of files being added to the archive. This means the system does not restrict exports exclusively to safe media files like images or videos, enabling threat actors to weaponize the feature to export core server files.

Attackers can exploit this to extract files with .php extensions, effectively bypassing WordPress’s intended security restrictions. The most severe consequence of this vulnerability is the potential exposure of the site’s vital wp-config.php file. Successful exfiltration of this file grants attackers immediate access to database credentials, as well as the cryptographic keys and salts used to secure user sessions.

With this highly sensitive information, an attacker could easily circumvent authentication mechanisms, escalate their privileges, and gain complete control over the affected web server.

Discovery and Remediation

Security researcher Dmitrii Ignatyev discovered and responsibly reported the flaw through the Wordfence Bug Bounty Program on February 23, 2026, receiving a $2,208 reward for his efforts.

Wordfence promptly responded by providing a protective firewall rule to its Premium, Care, and Response users on February 24, 2026, to block potential exploit attempts. Users of the free version of Wordfence received the same protection 30 days later, on March 26, 2026.

Nextend, the developers of the Smart Slider 3 plugin, acknowledged the report and swiftly released a fully patched version on March 24, 2026.

What You Should Do

• Update Immediately: Website administrators are strongly advised to update their Smart Slider 3 plugin to version 3.5.1.34 or higher without delay to secure their environments.
• Review User Permissions: Regularly audit user accounts and ensure that only necessary permissions are granted, especially for sites allowing user registration.
• Implement Web Application Firewall (WAF): Utilize a robust WAF, such as Wordfence Premium, to provide an additional layer of protection against known and zero-day vulnerabilities.
• Backup Regularly: Maintain frequent and secure backups of your WordPress site and database to facilitate recovery in case of a compromise.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.