Critical WordPress Plugin Flaw Leaves 500,000 Sites Exposed to Credential Theft

A widely used WordPress plugin carried a serious security vulnerability that could have allowed attackers to steal login credentials, encryption keys, and sensitive server configuration data — and nearly half a million websites have yet to apply the fix.

Smart Slider 3, active on more than 800,000 websites globally, enables users to build responsive sliders and visual content blocks without writing code. Security researcher Dmitrii Ignatyev discovered in late February 2026 that versions 3.5.1.33 and older contained an Arbitrary File Read vulnerability — a flaw that allows authenticated attackers to access and read files directly on the web server.

How the vulnerability works

The flaw stems from missing permission checks in Smart Slider 3's AJAX export functions.While a security token — known as a nonce — exists within the plugin, authenticated users are able to obtain it. This means even low-privileged accounts, such as basic subscriber accounts, can trigger the export process.

Once triggered, the plugin's actionExportAll() function packages files into a downloadable ZIP archive using file_get_contents() — without validating the file type or source. This allows an attacker to include arbitrary server files in the export, including sensitive configuration files such as wp-config.php, which typically contains database credentials, secret keys, and salt data.

The lack of restrictions enables authenticated attackers to read confidential data stored on the server.

Why the risk may be higher than its score suggests

The vulnerability was assigned a medium severity score — largely because attackers must be authenticated to exploit it. However, security experts have pointed out that membership and subscription options are increasingly common across WordPress-powered platforms, meaning a basic free account on an affected site could be enough to carry out the attack.

For businesses running WordPress sites with open registration, e-commerce portals, or member-only content, the practical risk is significantly higher than the official severity rating implies.

Who found it — and what happened next

Security researcher Dmitrii Ignatyev first spotted the bug in late February 2026 and reported his findings to Wordfence in early March 2026. He received a $2,200 bug bounty for the discovery. Nextendweb, the maintainers of Smart Slider 3, responded by releasing a patched version — 3.5.1.34 — which closes the vulnerability entirely.

However, at the time of writing, the patched version had been downloaded just 308,575 times — meaning approximately 500,000 websites remain exposed.

There are currently no confirmed reports of the vulnerability being exploited in the wild, but security researchers warn that the window between disclosure and active exploitation is narrowing across the industry.

The broader WordPress plugin security problem

WordPress itself is generally considered a secure platform. The risk lies in its vast ecosystem of third-party plugins and themes — particularly free ones, which are often built and maintained by small teams, freelance developers, or enthusiasts.

Many free plugins are abandoned or poorly maintained despite remaining widely installed. Security researchers consistently advise WordPress users and administrators to keep all plugins, themes, and the core platform updated at all times, remove any plugins not actively in use, and review default security and privacy settings regularly.

For businesses, this means treating plugin management as an ongoing security responsibility — not a one-time setup task.

What to do now

• Update Smart Slider 3 to version 3.5.1.34 immediately
• Audit all installed WordPress plugins and remove any that are unused or unmaintained
• Review site user roles and restrict open registration where it is not business-critical
• Check server logs for any unusual export activity in recent weeks
• Ensure wp-config.php and other sensitive configuration files have not been accessed or modified