A security flaw exists in the Smart Slider 3 WordPress plugin, which is installed on more than 800,000 websites. This flaw could allow even users with basic access, like subscribers, to view any file on the server.

With this vulnerability, a logged-in attacker could potentially access sensitive data such as the wp-config.php file, which contains database login details, security keys, and salt values. This could lead to user data being stolen or the entire website being compromised.

Smart Slider 3 is a widely used WordPress plugin for building and managing interactive image and content sliders. It features an easy-to-use editor with drag-and-drop functionality and numerous pre-designed templates.

The security vulnerability, identified as CVE-2026-3098, was found by security researcher Dmitrii Ignatyev and affects all versions of the Smart Slider 3 plugin up to and including version 3.5.1.33.

It has been assigned a medium severity level because it requires a user to be logged in to exploit it. However, this still poses a risk to many websites that offer user accounts or subscriptions, which is a prevalent feature.

The vulnerability arises from a lack of proper permission checks in the plugin’s AJAX export functions, allowing any logged-in user, including subscribers, to use these functions.

According to researchers at Defiant, the company behind the Wordfence security plugin, the ‘actionExportAll’ function is missing checks to validate file types and sources, enabling attackers to read and export any server file.

The presence of a nonce value is not a sufficient security measure because authenticated users can easily obtain it.

“The vulnerable version of this function lacks validation for file types and sources, meaning that not only image or video files can be exported, but also .php files,” explains István Márton, a vulnerability researcher working with Defiant.

“This allows attackers with very limited permissions, such as subscribers, to read any file on the server, including the website’s wp-config.php file, which stores sensitive database credentials, keys, and salts.”

Ignatyev reported this vulnerability to Wordfence on February 23. Wordfence researchers confirmed the vulnerability and then notified Nextendweb, the developers of Smart Slider 3.

Nextendweb acknowledged the report on March 2 and released a fix on March 24 with the release of Smart Slider version 3.5.1.34.

According to WordPress.org statistics, the plugin has been downloaded 303,428 times in the past week. This indicates that at least 500,000 WordPress sites are potentially vulnerable due to running an outdated version of the Smart Slider 3 plugin.

While there are no reports of CVE-2026-3098 being actively exploited now, this status may change soon, so website owners should update immediately.