EUVD-2026-19956
GHSA-m7hj-m974-fx49
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Lifecycle Timeline
3Description
The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.
Analysis
Smart Slider 3 plugin for WordPress through version 3.5.1.33 allows authenticated attackers with Contributor-level access to enumerate slider metadata and create, modify, or delete image storage records due to missing capability checks in multiple AJAX controller actions. The vulnerability exploits exposed nonce tokens on post editor pages combined with incomplete permission validation, enabling privilege escalation from Contributor to administrative-equivalent capabilities for slider management without requiring unfiltered_html permissions. …
Sign in for full analysis, threat intelligence, and remediation guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today