File read flaw in Smart Slider plugin impacts 500K WordPress sites

A file-read vulnerability (CVE-2026-3098) in the Smart Slider 3 WordPress plugin (<= 3.5.1.33) allows any authenticated user, including subscribers, to export and read arbitrary server files—potentially exposing wp-config.php and database credentials. Wordfence validated a proof-of-concept and the vendor released a patch in version 3.5.1.34, but roughly 500,000 sites are estimated to still run vulnerable versions, so prompt patching is advised.