CVE-2026-3098
CVSS 6.5 MEDIUM: the Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function. EPSS 0.5% (38th percentile).
Vulnerabilities & Exploits · Web App Attack
A file-read flaw in the Smart Slider 3 WordPress plugin allows authenticated subscriber-level users to read arbitrary server files. The bug affects versions through 3.5.1.33 on over 800,000 sites and can expose wp-config.php; tracked as CVE-2026-3098 and rated medium due to required authentication.
1 source · Mar 29
CVSS 6.5 MEDIUM: the Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function. EPSS 0.5% (38th percentile).
BleepingComputer
File read flaw in Smart Slider plugin impacts 500K WordPress sites
A vulnerability in the Smart Slider 3 WordPress plugin, active on more than 800,000 websites, can be exploited to allow subscriber-level users access to arbitrary files on the server.
originalPart of the PlainSec briefing for 2026-03-29
Every edition of this story: Smart Slider Vulnerability Lets Subscribers Read Server Files