WordPress Plugin Vulnerability Exposes Sensitive Data From 800,000+ Sites

A medium-severity authenticated arbitrary file read vulnerability (CVE-2026-3098) was disclosed in the Smart Slider 3 WordPress plugin (≈800,000 installs). The flaw in the plugin's export workflow and lack of capability checks allows authenticated low-privilege users to export arbitrary server files (including wp-config.php), risking full site compromise; the issue was responsibly disclosed by a researcher, Wordfence issued temporary firewall protections, and Nextend released a patched plugin version 3.5.1.34 on March 24, 2026.