CVE-2026-3098 - Vulnerability Analysis

Overview

Smart Slider 3 plugin for WordPress <= 3.5.1.33 contains an arbitrary file read vulnerability caused by improper access control in the 'actionExportAll' function, letting authenticated attackers with Subscriber-level access read arbitrary files on the server.

Severity & Score

Impact

Authenticated attackers can read arbitrary files, potentially exposing sensitive information.

Mitigation

Update to a version later than 3.5.1.33 or the latest available version.

References

• https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.32/Nextend/SmartSlider3/Application/Admin/Sliders/ControllerSliders.php#L57
• https://plugins.trac.wordpress.org/changeset/3489689/smart-slider-3
• https://www.wordfence.com/threat-intel/vulnerabilities/id/e2ce9caf-2ca2-401c-acc7-76be2fd72f36?source=cve

Social Media Activity(1 post)

CyberVeille.ch

@cyberveille

Mar 30, 2026

📢 CVE-2026-3098 : faille de lecture de fichiers dans Smart Slider 3 expose 500 000 sites WordPress 📝 ## 🔍 Contexte Publié le 29 mars 2026 par BleepingComputer, cet a... 📖 cyberveille : https://cyberveille.ch/posts/2026-03-30-cve-2026-3098-faille-de-lecture-de-fichiers-dans-smart-slider-3-expose-500-000-sites-wordpress/ 🌐 source : https://www.bleepingcomputer.com/news/security/file-read-flaw-in-smart-slider-plugin-impacts-500k-wordpress-sites/ #CVE_2026_3098 #IOC #Cyberveille

View original post

GitHub Repositories(1 repo)

• https://github.com/George0Papasotiriou/LLM-Jailbreak-via-Chain-of-Logic-Injection-CVE-2026-3098

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner