The Smart Slider 3 plugin for WordPress contains a time‑based SQL injection flaw in the sliderid parameter. Because the parameter is not properly escaped or prepared, an attacker who has administrator‑level access can append malicious SQL statements to legitimate queries and retrieve sensitive data from the database. The weakness is an example of Vulnerability CWE‑89. The impact is limited to data disclosure, not immediate code execution or privilege escalation, but it can allow the attacker to compromise application integrity by manipulating data.

The vulnerability affects the Smart Slider 3 plugin for WordPress, made by nextendweb, in all releases up to and including version 3.5.1.28. Any WordPress site that has the plugin installed and where a user has administrator or higher privileges is potentially affected. Sites running later releases are not impacted.

The CVSS score of 4.9 indicates moderate severity. The EPSS score of less than 1% shows a low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. However, because the attack requires a legitimate administrator credential, the risk is primarily for sites with weak account hygiene or compromised admin accounts. Attackers will need to send a crafted request to a URL that includes the sliderid parameter while authenticated. The exploitation path leverages human‑managed authentication rather than a zero‑day vulnerability.