High-Severity Vulnerability in Smart Slider 3 Plugin Exposes 800,000+ WordPress Sites A critical security flaw (CVE-2026-3098) has been identified in Smart Slider 3, a widely used WordPress plugin with over 800,000 active installations. The vulnerability, classified as an Authenticated Arbitrary File Read, allows attackers with minimal permissions such as subscriber-level access to download sensitive configuration files from affected servers. The flaw resides in the plugin’s export functionality, specifically within the `actionExportAll()` function of the `ControllerSliders` class. While the feature is designed to compile and export slider assets, it lacks proper capability checks and file validation, enabling attackers to bypass security measures. Exploiting this oversight, threat actors can extract core server files, including the wp-config.php file, which contains database credentials, cryptographic keys, and session salts. If compromised, this data could allow attackers to escalate privileges, bypass authentication, and gain full control of the targeted website. The risk is heightened for sites with open user registration, as even low-privilege accounts can exploit the flaw. Security researcher Dmitrii Ignatyev discovered the vulnerability and reported it via the Wordfence Bug Bounty Program on February 23, 2026, earning a $2,208 reward. Wordfence deployed a firewall rule to protect Premium, Care, and Response users on February 24, with free users receiving the update on March 26. The plugin’s developers, Nextend, released a patched version (3.5.1.34) on March 24, 2026, addressing the issue. Administrators are advised to update immediately to mitigate potential exploitation.