Home / Technology / Critical Flaw: Smart Slider 3 Exposes WordPress Sites
Critical Flaw: Smart Slider 3 Exposes WordPress Sites
30 Mar
Summary
- A flaw in Smart Slider 3 allowed hackers to read sensitive server files.
- Vulnerability in older versions exposed credentials and configuration data.
- Nearly 500,000 WordPress sites remain vulnerable to this exploit.
A severe Arbitrary File Read vulnerability in the Smart Slider 3 WordPress plugin, active on over 800,000 sites, has put many websites at risk. Versions 3.5.1.33 and older are susceptible, allowing authenticated users to access and read arbitrary files from the server.
The flaw, identified in the plugin's AJAX export functions, lacks proper permission checks. This enables even low-privileged accounts to exfiltrate sensitive data, including login credentials and configuration details like wp-config.php.
Security researcher Dmitrii Ignatyev discovered the bug in late February 2026 and received a $2,200 bounty. A patch is available in version 3.5.1.34, but an estimated 500,000 sites have yet to update.
Users are strongly advised to update the Smart Slider 3 plugin immediately to mitigate the risk of data compromise. WordPress users should maintain regular updates for all plugins and themes.
