Read the docs
TI-2026-26699 Aliases CVE-2026-34424GHSA-37pc-8f3j-hpmr

Smart Slider 3 Pro 3.5.1.35 Supply Chain Attack Remote Access Toolkit

Priority MEDIUM 49CWE-506Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-506.

Summary

Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00561 46th percentileScored 2026-11-07
Fix Fixed Smart Slider 3 Pro for WordPress (Nextendweb): 3.5.1.36Smart Slider 3 Pro for Joomla (Nextendweb): 3.5.1.36

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nextendwebSmart Slider 3 Pro for WordPress3.5.1.353.5.1.36Patch availableCNA
nextendwebSmart Slider 3 Pro for Joomla3.5.1.353.5.1.36Patch availableCNA
  • Smart Slider 3 Pro for WordPress Vendornextendweb Affected 3.5.1.35 Fixed in 3.5.1.36 Patch available CNA
  • Smart Slider 3 Pro for Joomla Vendornextendweb Affected 3.5.1.35 Fixed in 3.5.1.36 Patch available CNA

Remediation

  • Fix · CNA Smart Slider 3 Pro for WordPress (Nextendweb) Fixed in 3.5.1.36
  • Fix · CNA Smart Slider 3 Pro for Joomla (Nextendweb) Fixed in 3.5.1.36

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-34424
  2. 2026-10-03 Alias added: GHSA-37pc-8f3j-hpmr
  3. 2026-10-25 EPSS moved to the below the 50th percentile

References

Patch 2

Advisory 1

Other 2

  • TI-2022-03102 Smart Slider 3 < 3.5.1.11 - PHP Object Injection CVSS 3.1HIGH 8.8
  • TI-2023-00625 Smart Slider 3 < 3.5.1.14 - Contributor+ Stored XSS CVSS 3.1MEDIUM 5.4
  • TI-2025-00900 Nextend Social Login Pro <= 3.1.16 - Authentication Bypass via Apple OAuth provider CVSS 3.1CRITICAL 9.8
  • TI-2024-09179 Nextend Social Login Pro <= 3.1.14 - Authentication Bypass via WordPress.com OAuth provider CVSS 3.1CRITICAL 9.8
  • TI-2022-22647 WordPress Smart Slider 3 Plugin <= 3.5.1.9 is vulnerable to PHP Object Injection CVSS 3.1HIGH 8.8
  • TI-2015-03834 Cross-site scripting (XSS) vulnerability in the new_Twitter_sign_button function in… CVSS 3.0MEDIUM 6.1
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences