CVE-2026-34424 - Vulnerability Analysis

Overview

Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla contains a remote code execution caused by a compromised update system allowing unauthenticated attackers to execute arbitrary code via HTTP headers and maintain persistence through multiple injection points.

Severity & Score

Impact

Unauthenticated attackers can execute arbitrary code, create backdoors, and maintain persistent access, leading to full system compromise.

Mitigation

Update to the latest version of Smart Slider 3 Pro.

References

• https://patchstack.com/articles/critical-supply-chain-compromise-in-smart-slider-3-pro-full-malware-analysis/
• https://patchstack.com/database/wordpress/plugin/nextend-smart-slider3-pro/vulnerability/wordpress-smart-slider-3-plugin-3-5-1-35-backdoor-vulnerability
• https://smartslider.helpscoutdocs.com/article/2143-joomla-security-advisory-smart-slider-3-pro-3-5-1-35-compromise
• https://smartslider.helpscoutdocs.com/article/2144-wordpress-security-advisory-smart-slider-3-pro-3-5-1-35-compromise
• https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/

Related Resources

• Vulnerability Intelligence Dashboard
• Credential Scanner