Smart Slider 3 EUVD-2026-34944

Exploitation requires an authenticated session with WordPress administrator-level privileges or above (CVSS PR:H confirmed). The vulnerable code path is exercised through the slider export and backup functionality; specifically, the replaceHTMLImage function in ExportSlider.php must be reachable, meaning the Smart Slider 3 plugin must be installed and activated. No special non-default configuration beyond plugin activation is implied. Limiting factors are significant: the PR:H requirement eliminates unauthenticated and low-privileged (subscriber, editor, author) exploitation; the unchanged scope (S:U) means the attacker cannot escape the WordPress application context to execute code; and the impact is strictly read-only (I:N/A:N). Exploitation is therefore realistically constrained to insiders with admin access, attackers who have already compromised an admin account through other means (phishing, credential stuffing), or multi-step attack chains where admin privilege was previously escalated.

The CVSS 4.9 Medium score is driven by network delivery (AV:N) and high confidentiality impact (C:H), but is moderated by high privilege requirements (PR:H), resulting in a score that accurately reflects constrained real-world exploitability. The PR:H prerequisite means only WordPress administrators or super-administrators can trigger the flaw, ruling out unauthenticated or low-privileged exploitation. EPSS data was not supplied in the intelligence inputs and cannot be cited. There is no CISA KEV listing and no confirmed public proof-of-concept code, making this a low-urgency issue for most organizations unless admin account compromise is already a concern. The I:N and A:N impact components confirm this is a pure confidentiality (read-only file disclosure) issue - no code execution or service disruption is possible via this vector alone. However, file disclosure of wp-config.php or similar credential files could serve as a pivot to more severe compromise, so the secondary risk warrants timely patching despite the modest base score.

An attacker who has obtained or already holds WordPress administrator credentials authenticates to the admin panel and submits a crafted slider export or backup request with a path-traversal sequence (e.g., ../../wp-config.php) passed to the replaceHTMLImage function. The server resolves the traversal, reads the target file outside the plugin directory, and returns its contents to the attacker - potentially exposing database credentials, secret keys, and salts stored in wp-config.php. No public proof-of-concept code is confirmed, but the vulnerability is straightforward to reproduce given source code visibility in the WordPress plugin repository.