The Smart Slider 3 plugin for WordPress contains missing capability checks on several Ajax controller actions. The display_admin_ajax() method does not verify the unfiltered_html capability, and other actions only validate a nonce without checking user permissions. This flaw allows an authenticated user with Contributor or higher role to enumerate slider metadata, create, modify, or delete image storage records using the exposed nextend_nonce found on post editor pages. The primary impact is the loss of integrity and availability of slider content, potentially enabling defacement or removal of media assets.

The vulnerability affects all installations of the Smart Slider 3 plugin (nextendweb:Smart Slider 3) in versions up to and including 3.5.1.33. Users running these versions are susceptible to unauthorized data manipulation via the plugin’s Ajax endpoints.

The CVSS score for this issue is 5.4, indicating moderate severity. No EPSS score is published, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an authenticated account with Contributor-level access and the ability to retrieve the nextend_nonce from a post editor page. While the attack is not trivial, the absence of role-based checks combined with available upstream pages makes it relatively straightforward for a legitimate contributor to discover the necessary parameters. Overall risk is moderate, with potential for unauthorized content changes on the affected sites.