CYBERSIXT Signal Over Noise
All CVEs
Vulnerability intelligence

CVE-2026-3098

CWE-862

The Smart Slider 3 plugin for WordPress is vulnerable to Arbitrary File Read in all versions up to, and including, 3.5.1.33 via the 'actionExportAll' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.

CVSS Score
6.5
Medium
EPSS — Exploit Probability
0.5%
Riskier than 39% of all CVEs
Exploitation
Not in CISA KEV
No federal exploitation record
Remediation
unknown
Check vendor advisories
NVD entry PoC / advisory

1 article across 1 outlet · first covered Apr 6, 2026 · latest Apr 6, 2026

Coverage timeline