The Smart Slider 3 plugin has a flaw in the actionExportAll function that allows an attacker who can log into the WordPress site with a role of Subscriber or higher to read any file on the server through a crafted request. The vulnerability is a classic arbitrary file read (CWE‑862). Once exploited, the attacker can obtain sensitive data, configuration files, or credentials stored on the server, compromising confidentiality. Because the access precondition is only a legitimate user role, the risk is high for sites with many authenticated users.

This issue affects all installations of the nextendweb Smart Slider 3 plugin version 3.5.1.33 and earlier, regardless of the WordPress core version. Any WordPress website using a vulnerable plugin version is at risk until the component is updated.

The CVSS base score of 6.5 reflects a moderate severity with Medium exploitability. An attacker needs only an authenticated session, which many websites provide to subscribers, so exploitation is straightforward. No public exploit code appears in the public feeds, and the vulnerability is not listed in the CISA KEV catalog, but the nature of the flaw still makes it a serious target for attackers scanning for vulnerable sites. The lack of an EPSS score means we do not have a publicly available estimate of exploit frequency.