WordPress Plugin Vulnerability Exposes Data from 800,000 Sites
Basically, a flaw in a popular WordPress plugin lets hackers steal sensitive data from many websites.
A severe vulnerability in Smart Slider 3 affects over 800,000 WordPress sites. This flaw allows attackers to access sensitive data. Immediate updates are crucial to prevent exploitation.
The Flaw
A significant security vulnerability has been discovered in Smart Slider 3, a widely used WordPress plugin with over 800,000 active installations. Tracked as CVE-2026-3098, this flaw allows attackers with minimal permissions to access sensitive files directly from the server. The vulnerability lies within the plugin’s export functionality, specifically in the actionExportAll() function of the ControllerSliders class.
In a typical scenario, this function compiles and downloads a slider export ZIP file. While one part of this process is protected by a security nonce, attackers can exploit vulnerable versions of the plugin to obtain this token. More alarmingly, the AJAX functions do not adequately check user roles, permitting any authenticated user—even those with basic subscriber access—to trigger the export action without needing administrative rights.
What's at Risk
The primary risk associated with this vulnerability is the potential exposure of the site's wp-config.php file. If an attacker downloads this file, they gain access to crucial database credentials and cryptographic keys used for user session security. With this information, they can easily bypass authentication, escalate privileges, and take full control of the affected server.
This vulnerability is particularly critical for websites that allow open user registration. Any standard subscriber account can be leveraged for an attack, increasing the number of potential victims significantly. The implications of such a breach can be catastrophic, leading to data theft, unauthorized access, and even complete site takeover.
Patch Status
Security researcher Dmitrii Ignatyev discovered this flaw and reported it through the Wordfence Bug Bounty Program on February 23, 2026. In response, Wordfence acted quickly, releasing a protective firewall rule to its Premium, Care, and Response users the very next day. For users of the free version, this protection was rolled out 30 days later, on March 26, 2026.
The developers at Nextend acknowledged the report and released a patched version of the plugin on March 24, 2026. Website administrators are strongly urged to update their Smart Slider 3 plugin to version 3.5.1.34 immediately to mitigate the risk of exploitation.
Immediate Actions
To protect your website from this vulnerability, follow these steps:
- Update the Smart Slider 3 plugin to the latest version.
- Review user roles and permissions on your WordPress site to limit access.
- Monitor your website for any suspicious activity or unauthorized access attempts.
By taking these actions, you can significantly reduce the risk of data theft and ensure your site remains secure against potential attacks. Cybersecurity is an ongoing battle, and staying informed about vulnerabilities is crucial for safeguarding your digital assets.