Arbitrary File Read Vulnerability in Smart Slider 3 Plugin for WordPress
CVE-2026-3098

6.5MEDIUM

Key Information:

Vendor

WordPress
Status
Smart Slider 3
Vendor
CVE Published:
27 March 2026

What is CVE-2026-3098?

The Smart Slider 3 plugin for WordPress features an Arbitrary File Read vulnerability which allows authenticated attackers with subscriber-level access or higher to access sensitive information stored within files on the server. This issue arises through the 'actionExportAll' function in versions 3.5.1.33 and below, posing a significant risk to site security. Website administrators should consider updating the plugin or implementing security measures to mitigate potential exploitation.

Affected Version(s)

Smart Slider 3 0 <= 3.5.1.33

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/smart-slider-3...
https://plugins.trac.wordpress.org/changeset/3489689/smar...

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Dmitrii Ignatyev
.