Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi‑stage remote access toolkit injected through a compromised update system. The compromise allows unauthenticated attackers to trigger pre‑authentication remote shell execution via crafted HTTP headers, establish authenticated backdoors that accept arbitrary PHP or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must‑use plugins and core file modifications. These capabilities provide attackers with full control over the compromised sites, compromising confidentiality, integrity, and availability of the affected systems.

The vulnerability affects Nextendweb’s Smart Slider 3 Pro plugin for Joomla and for WordPress, specifically version 3.5.1.35. No other versions or products are listed as impacted.

The CVSS score of 9.3 indicates a critical severity. Exploitability data from the exploit prediction service is unavailable, and the vulnerability is not yet listed in the CISA Known Exploited Vulnerabilities catalog. Based on the description, the likely exploitation path involves sending a specially crafted HTTP request that includes malicious headers to the vulnerable site, which then executes arbitrary code; at the same time the attacker can add administrative accounts and alter core files for persistence. The absence of a requirement for prior authentication greatly increases the risk to unprotected sites.