File read flaw in Smart Slider plugin impacts 500K WordPress sites

A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, can be exploited to allow subscriber-level users access to arbitrary files on the server. An authenticated attacker could use it to access sensitive files, such as wp-config.php, which includes database credentials, keys, and salt data, creating the risk for user data theft and complete website takeover. Smart Slider 3 is one of the most popular WordPress plugins for creating and managing image sliders and content carousels. It offers an easy-to-use drag-and-drop editor and a rich set of templates to choose from. The security issue, tracked as CVE-2026-3098, was discovered and reported by researcher Dmitrii Ignatyev and impacts all versions of the Smart Slider 3 plugin through 3.5.1.33. It received a medium severity score due to requiring authentication. However, this only limits the impact to websites with membership or subscription options, a feature that is common on many platforms these days. The vulnerability stems from missing capability checks in the plugin’s AJAX export actions. This allows any authenticated user, including subscribers, to invoke them. According to researchers at WordPress security company Defiant, the developer of the Wordfence security plugin, the 'actionExportAll' function lacks file type and source validation, thus allowing arbitrary server files to be read and added to the export archive. The presence of a nonce does not prevent abuse because it can be ...