What is the CVSS score of CVE-2026-4065?

CVE-2026-4065 has a CVSS 3.1 base score of 5.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4065

EUVD-2026-19956 MEDIUM

Missing Authorization (CWE-862)

2026-04-07 Wordfence

GHSA-m7hj-m974-fx49

WordPress Authentication Bypass

5.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 07, 2026 - 21:31 euvd

EUVD-2026-19956

Analysis Generated

Apr 07, 2026 - 21:31 vuln.today

CVE Published

Apr 07, 2026 - 21:26 nvd

MEDIUM 5.4

DescriptionCVE.org

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.

AnalysisAI

Smart Slider 3 plugin for WordPress through version 3.5.1.33 allows authenticated attackers with Contributor-level access to enumerate slider metadata and create, modify, or delete image storage records due to missing capability checks in multiple AJAX controller actions. The vulnerability exploits exposed nonce tokens on post editor pages combined with incomplete permission validation, enabling privilege escalation from Contributor to administrative-equivalent capabilities for slider management without requiring unfiltered_html permissions. No public exploit code or active exploitation has been identified at time of analysis.

Technical ContextAI

Smart Slider 3 is a WordPress plugin for creating responsive image sliders. The vulnerability stems from improper implementation of WordPress capability checking in AJAX handlers. The display_admin_ajax() method fails to invoke checkForCap(), which enforces the unfiltered_html capability required for admin operations. Instead, several controller actions in ControllerAjaxSliders and ControllerAjaxImage rely solely on validateToken() nonce validation without calling validatePermission(), which would enforce proper capability restrictions. This design flaw violates WordPress security best practices by trusting nonce validation as a substitute for capability checks. CWE-862 (Missing Authorization) categorizes this as improper enforcement of intended access restrictions. The nextend_nonce, exposed in post editor page HTML, becomes a key attack component when combined with a Contributor-level WordPress account, allowing attackers to forge requests that modify slider and image storage data.

RemediationAI

Update Smart Slider 3 to a patched version released after 3.5.1.33. Vendor-released patch information and exact fix versions are referenced in the WordPress plugin repository changeset at https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489689%40smart-slider-3%2Ftrunk&old=3439582%40smart-slider-3%2Ftrunk, which shows code changes correcting the capability check implementation. WordPress site administrators should immediately check for available updates in the Plugins menu and enable automatic updates for this plugin. As an interim mitigation, restrict Contributor-level account access on WordPress sites running vulnerable versions, or use WordPress role management plugins to prevent untrusted contributors from accessing post editor pages where the nextend_nonce is exposed. Monitor AJAX requests to wp-admin/admin-ajax.php with action=smart-slider3 for suspicious patterns from lower-privileged accounts.