Loading story…
A critical vulnerability in the Smart Slider 3 WordPress plugin exposed more than 800,000 websites to arbitrary file read attacks, allowing authenticated users to access sensitive files on affected servers. The flaw, tracked as CVE-2026-3098 and rated CVSS 6.5, affects version 3.5.1.33 and earlier of the widely used plugin.
Researchers said the issue stems from the plugin’s actionExportAll() function, which does not properly validate the format and source of requested files. That weakness lets even low-privileged users, including subscribers, read arbitrary files such as wp-config.php, creating a risk of credential theft and broader compromise. Defenders were urged to update immediately to Smart Slider 3 3.5.1.34 or later.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
The references state that the recommended mitigation for CVE-2026-3098 is to update Smart Slider 3 immediately to version 3.5.1.34 or later. More than 800,000 WordPress sites were described as affected by the vulnerable plugin versions.
Security researchers warned about CVE-2026-3098, an arbitrary file read flaw in the WordPress Smart Slider 3 plugin affecting version 3.5.1.33 and earlier. The issue allows any authenticated user, including subscribers, to read arbitrary server files such as wp-config.php due to improper validation in the actionExportAll() function.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A file-read vulnerability in the **Smart Slider 3** WordPress plugin could let authenticated users with only subscriber-level access read arbitrary files from the server, including `wp-config.php`, on more than 500,000 likely unpatched sites. The flaw, tracked as **`CVE-2026-3098`**, affects all versions through **`3.5.1.33`** and stems from missing capability checks and insufficient file validation in the plugin’s AJAX export functionality. Researcher Dmitrii Ignatyev reported the issue, which was validated by Wordfence before developer Nextendweb released a fix in **Smart Slider 3 `3.5.1.34`**. Security reporting said there was no evidence of active exploitation at publication time, but successful attacks could expose database credentials, cryptographic keys, and WordPress salt values, creating a path to broader site compromise.
Jun 29, 2026
A critical vulnerability in the WordPress plugin **Ninja Forms – File Uploads** has exposed more than **50,000 sites** to unauthenticated arbitrary file upload, with security researchers and CSIRT.SK reporting active exploitation in the wild. Tracked as `CVE-2026-0740`, the flaw affects versions **3.3.26 and earlier** and stems from insufficient validation of uploaded file types, file extensions, and file paths in `NF_FU_AJAX_Controllers_Uploads::handle_upload`, allowing attackers to upload malicious files, including PHP scripts. Successful exploitation can lead to **remote code execution** and full site compromise, giving attackers a path to persistent access and broader server takeover. Defenders are urged to update immediately to **version 3.3.27 or later** and review affected WordPress installations for unauthorized uploads or filesystem changes, as public reporting indicates the vulnerable plugin was deployed on tens of thousands of websites at the time of disclosure.
Jul 24, 2026
A critical vulnerability tracked as **CVE-2026-49777** was disclosed in ShapedPlugin's **Product Slider Pro for WooCommerce** WordPress plugin, with reports describing it as a **backdoor** and **supply-chain remote code execution** issue. The flaw was assigned **CWE-1284** and a **CVSS 3.1** score reflecting critical impact (`AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H`), indicating that attackers could potentially compromise confidentiality, integrity, and availability without authentication or user interaction. Public reporting shows inconsistent affected-version boundaries, with one source listing versions **before 3.5.3** and another identifying versions **before 3.5.4**, while a Nuclei template pull request labels the issue as **KEV** and ties it to active detection efforts. The CVE record also notes that the vendor said the issue was fixed in an existing release but did not clearly publish a definitive patched version, leaving defenders to verify plugin versions carefully and treat older deployments as potentially exposed until remediation guidance is clarified.
Jun 29, 2026