Smart Slider 3
CVE-2026-12385
MEDIUM
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Network-reachable Ajax endpoint requires only Contributor authentication (PR:L); nonce acquisition is trivial; confidentiality limited to post excerpt exposure with no integrity or availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Smart Slider 3 plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.5.1.37 via the 'keyword' parameter. This makes it possible for authenticated attackers, with contributor-level access and above, to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts authored by any user, including Administrators and Editors. The required nonce is emitted on /wp-admin/post-new.php, which is accessible to Contributor-level users via the edit_posts capability, meaning any Contributor can obtain the nonce needed to trigger the injection.
AnalysisAI
Sensitive information exposure in the Smart Slider 3 WordPress plugin (all versions up to and including 3.5.1.37) allows authenticated Contributor-level users to extract titles and full content excerpts of private, draft, pending, trashed, and auto-draft posts belonging to any user on the site - including Administrators and Editors - via the unsecured 'keyword' Ajax parameter. The attack barrier is further lowered because the required nonce is automatically emitted on /wp-admin/post-new.php, a page accessible to any Contributor by default through the edit_posts capability, making nonce acquisition trivial. No public exploit code and no confirmed active exploitation (CISA KEV) have been identified at time of analysis.
Technical ContextAI
The vulnerability resides in the Smart Slider 3 plugin by Nextendweb (CPE: cpe:2.3:a:nextendweb:smart_slider_3:*:*:*:*:*:*:*:*), specifically in the Ajax content handler at Nextend/Framework/Content/ControllerAjaxContent.php and the underlying WordPress content query logic in Nextend/Framework/Content/WordPress/WordPressContent.php. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): the plugin's content search Ajax endpoint accepts a 'keyword' parameter and queries WordPress posts without enforcing authorization on the post status, allowing it to return posts in private, draft, or trashed states that the requesting user should not be able to view. WordPress nonces, handled in PlatformForm.php, are designed to prevent CSRF but carry no authorization semantics - they merely confirm the request originated from an admin page session. Because /wp-admin/post-new.php is reachable by anyone with the edit_posts capability (granted to Contributors by default), the nonce required to invoke the vulnerable endpoint is freely obtainable by the lowest-tier authenticated role.
RemediationAI
A fix is available via WordPress plugin trac changeset 3599123 (https://plugins.trac.wordpress.org/changeset/3599123/smart-slider-3); administrators should update Smart Slider 3 to the version incorporating this changeset - the exact released patched version number is not independently confirmed from the provided data, so verify the current release version in the WordPress plugin directory or via the Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/a782d975-74ce-4265-9312-435b3585a5c6 before acting. As an interim compensating control, administrators of sites with open Contributor registration can remove the edit_posts capability from the Contributor role using a capability management plugin, which prevents Contributors from accessing /wp-admin/post-new.php and thus blocks nonce acquisition - the trade-off is that Contributors will lose the ability to create draft posts. Alternatively, temporarily deactivating the Smart Slider 3 plugin entirely eliminates the attack surface at the cost of slider functionality. Restricting Contributor registration to trusted users only reduces exposure on sites where this role is broadly assigned.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-200 – Information Exposure
View allSame technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today