EUVD-2026-19956
GHSA-m7hj-m974-fx49
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A01:2025 - Broken Access Control
ASVS 5.0
V8 - Authorization Authorization checks on every request
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | CVSS 5.4 (Medium) with attack vector Network, low complexity, and low privilege requirements reflects a realistic threat profile. The CVSS vector (PR:L/UI:N/S:U/C:L/I:L/A:N) confirms unauthenticated is not possible-an authenticated Contributor account is required, limiting the attack surface. However, real-world risk is elevated due to several factors: (1) Contributor accounts are commonly issued on multi-author WordPress sites and managed hosting environments, (2) nonce exposure on editor pages is passive reconnaissance, not a complex exploit, (3) the vulnerability affects slider management core functionality across all versions through 3.5.1.33, (4) automation is trivial once nonce and AJAX endpoints are identified. The low CVSS impact scores (Confidentiality:Low, Integrity:Low, Availability:None) understate the practical damage-unauthorized slider modification can deface website content and compromise image galleries, affecting site reputation and SEO. Sites with untrusted or numerous Contributor accounts face elevated risk. This is a legitimate priority for WordPress administrators, particularly those running multi-author sites, despite the medium CVSS rating. |
| Exploit ScenarioDerived | An attacker with a Contributor account on a WordPress site (common on multi-author blogs or client sites) visits a post editor page and extracts the nextend_nonce token from the page HTML. The attacker then crafts AJAX requests to wp-admin/admin-ajax.php with action=smart-slider3 and the stolen nonce, targeting ControllerAjaxSliders or ControllerAjaxImage methods to list all sliders, modify slider content (changing images or descriptions), or delete image storage records. Because the plugin skips capability checks, the Contributor-level request is honored as if from an admin. The attacker can deface slider galleries on the site's homepage or delete images used across multiple sliders, causing content loss without leaving traditional audit trails. No public exploit code has been published, but the vulnerability is straightforward to exploit for anyone with basic WordPress and HTTP request knowledge. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 07, 2026
Smart Slider 3 plugin for WordPress through version 3.5.1.33 allows authenticated attackers with Contributor-level access to enumerate slider metadata and create, modify, or delete image storage records due to missing capability checks in multiple AJAX controller actions. The vulnerability exploits exposed nonce tokens on post editor pages combined with incomplete permission validation, enabling privilege escalation from Contributor to administrative-equivalent capabilities for slider management without requiring unfiltered_html permissions. No public exploit code or active exploitation has been identified at time of analysis.
RemediationAI
Update Smart Slider 3 to a patched version released after 3.5.1.33. Vendor-released patch information and exact fix versions are referenced in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489689%40smart-slider-3%2Ftrunk&old=3439582%40smart-slider-3%2Ftrunk, which shows code changes correcting the capability check implementation. WordPress site administrators should immediately check for available updates in the Plugins menu and enable automatic updates for this plugin. As an interim mitigation, restrict Contributor-level account access on WordPress sites running vulnerable versions, or use WordPress role management plugins to prevent untrusted contributors from accessing post editor pages where the nextend_nonce is exposed. Monitor AJAX requests to wp-admin/admin-ajax.php with action=smart-slider3 for suspicious patterns from lower-privileged accounts.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Smart Slider 3 is a WordPress plugin for creating responsive image sliders. The vulnerability stems from improper implementation of WordPress capability checking in AJAX handlers. The display_admin_ajax() method fails to invoke checkForCap(), which enforces the unfiltered_html capability required for admin operations. Instead, several controller actions in ControllerAjaxSliders and ControllerAjaxImage rely solely on validateToken() nonce validation without calling validatePermission(), which would enforce proper capability restrictions. This design flaw violates WordPress security best practices by trusting nonce validation as a substitute for capability checks. CWE-862 (Missing Authorization) categorizes this as improper enforcement of intended access restrictions. The nextend_nonce, exposed in post editor page HTML, becomes a key attack component when combined with a Contributor-level WordPress account, allowing attackers to forge requests that modify slider and image storage data.
Know when Smart Slider 3 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
More in Smart Slider 3
View allThe Smart Slider 3 WordPress plugin before 3.5.1.11 unserialises the content of an imported file, which could lead to PH
The Smart Slider 3 WordPress plugin before 3.5.1.14 does not properly validate and escape some of its shortcode attribut
Smart Slider 3 plugin for WordPress allows authenticated attackers with Subscriber-level privileges to read arbitrary fi
Stored Cross-Site Scripting in Smart Slider 3 (WordPress plugin by Nextend) versions up to and including 3.5.1.38 allows
Stored cross-site scripting in the Smart Slider 3 WordPress plugin (Nextend, CPE nextendweb:smart_slider_3) up to and in
Directory traversal in the Smart Slider 3 WordPress plugin (all versions ≤ 3.5.1.36) exposes arbitrary server-side files
Deserialization of Untrusted Data vulnerability in Nextend Smart Slider 3.5.1.9. Rated medium severity (CVSS 4.3), this
Sensitive information exposure in the Smart Slider 3 WordPress plugin (all versions up to and including 3.5.1.37) allows
Exploit-DB