CVE-2026-34424: Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-34424?
CVE-2026-34424 is classified as a critical vulnerability due to its potential for remote code execution.
How do I fix CVE-2026-34424?
To fix CVE-2026-34424, you should update Smart Slider 3 Pro to the latest version immediately.
Who is affected by CVE-2026-34424?
CVE-2026-34424 affects users of Smart Slider 3 Pro version 3.5.1.35 for both WordPress and Joomla.
What impact does CVE-2026-34424 have on my website?
CVE-2026-34424 allows unauthenticated attackers to execute arbitrary commands, potentially leading to a full site compromise.
How did the vulnerability CVE-2026-34424 occur?
CVE-2026-34424 was introduced through a compromised update system in Smart Slider 3 Pro.