The Smart Slider 3 plugin for WordPress is a CWE‑200 Sensitive Information Exposure vulnerability that allows an attacker authenticated with contributor-level or higher privileges to retrieve private post data by sending a crafted request containing a malicious value in the 'keyword' parameter. The value is injected into an underlying WP_Query call, bypassing the plugin’s intended access control and exposing titles and full content excerpts of posts that are normally inaccessible—private, draft, pending, trashed, and auto‑draft posts created by any user, including administrators and editors.

Nextendweb Smart Slider 3 versions 3.5.1.37 and earlier are affected. The vulnerability exists in the plugin source files ControllerAjaxContent.php and WordPressContent.php as referenced in the code listings.

The CVSS base score for this vulnerability is 4.3, reflecting a moderate impact on confidentiality, with no impact on integrity or availability. The EPSS score of 0.00242 (<1%) indicates a very low probability of exploitation, and the issue is not listed in the CISA KEV catalog. Because the exploit requires authenticated contributor access and a nonce that is emitted on a page reachable by any contributor, the attack surface is limited to sites that grant contributors the edit_posts capability. Based on the source code, the 'keyword' parameter is injected directly into the arguments passed to WP_Query, effectively bypassing the plugin’s access controls and allowing any contributor to retrieve private, draft, or pending posts that would normally remain inaccessible. Exploitation is otherwise straightforward for anyone who can log in, exposing a wide array of private content without compromising the underlying WordPress installation. Administrators should treat this as a confidential data leak risk with potential for further attacks.