What is the CVSS score of CVE-2026-3098?

CVE-2026-3098 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. EPSS exploitation probability: 0.0%.

Which versions of WordPress are affected by CVE-2026-3098?

Organizations using for WordPress is vulnerable to Arbitrary File Read in all should be aware of notable risk from CVE-2026-3098, a missing authorization vulnerability rated CVSS 6.5.

How to fix or mitigate CVE-2026-3098?

Within 30 days: Identify affected systems running for WordPress is vulnerable to Arbitrary File Read in all and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

WordPress CVE-2026-3098

EUVD-2026-16531 MEDIUM

Missing Authorization (CWE-862)

2026-03-27 Wordfence

GHSA-vgx8-59x9-v7v9

WordPress Authentication Bypass

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Mar 27, 2026 - 04:00 euvd

EUVD-2026-16531

Analysis Generated

Mar 27, 2026 - 04:00 vuln.today

CVE Published

Mar 27, 2026 - 03:37 nvd

MEDIUM 6.5

DescriptionCVE.org

The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

AnalysisAI

Smart Slider 3 plugin for WordPress allows authenticated attackers with Subscriber-level privileges to read arbitrary files on the server via improper access controls in the 'actionExportAll' function. Affected versions include all releases up to and including 3.5.1.33. The vulnerability exposes sensitive files such as configuration data, database credentials, and private keys to attackers with low-privilege WordPress accounts. No public exploit code or active exploitation has been identified at the time of analysis.

Technical ContextAI

Smart Slider 3 (cpe:2.3:a:nextendweb:smart_slider_3:*:*:*:*:*:*:*:*) is a WordPress plugin developed by Nextend Web. The vulnerability stems from improper authorization enforcement (CWE-862: Missing Authorization) in the 'actionExportAll' administrative function. The ControllerSliders.php file at line 57 in the plugin's codebase fails to implement proper privilege escalation checks, allowing the export function to bypass typical WordPress capability restrictions. This permits Subscriber-level users-who normally have minimal permissions-to invoke functionality intended only for administrators, resulting in arbitrary file read access to the web server's filesystem.

RemediationAI

Update Smart Slider 3 plugin to a version released after 3.5.1.33, which includes fixes for the authorization bypass in the actionExportAll function (consult the WordPress.org plugin repository and official Nextend Web security advisories for the exact patched version number). As an interim measure for sites unable to immediately patch, implement capability restrictions by restricting Subscriber-level user creation to trusted accounts only, or disable public user registration if not required by your WordPress site configuration. Additionally, apply the principle of least privilege by regularly auditing active user accounts and removing unnecessary Subscriber-level access. Monitor server filesystem access logs for suspicious export activity, and consider deploying a Web Application Firewall (WAF) rule to detect repeated requests to the actionExportAll function from low-privilege user sessions.