Is CVE-2026-12385 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-12385 being exploited in the wild.

How severe is CVE-2026-12385?

Medium severity, with a CVSS score of 4.3, published 13 July 2026.

Which products and versions are affected?

Nextendweb Smart Slider 3 up to, and including, 3.5.1.37.

Is there a fix for CVE-2026-12385?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-12385 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-12385?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-12385: Nextendweb Smart Slider 3 sensitive information exposure via keyword parameter

CVE-2026-12385 · Severity: medium · CVSS 4.3 · Published 2026-07-13

Smart Slider 3, a popular WordPress plugin for creating visual sliders, contains a security flaw that allows users with low-level 'Contributor' accounts to view private content. An attacker could use this to read draft posts, private articles, and deleted content authored by site administrators or editors. This could lead to the exposure of sensitive business information or upcoming announcements before they are intended for public release.

Quick answers

Is CVE-2026-12385 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-12385 being exploited in the wild.
How severe is CVE-2026-12385?: Medium severity, with a CVSS score of 4.3, published 13 July 2026.
Which products and versions are affected?: Nextendweb Smart Slider 3 up to, and including, 3.5.1.37.
Is there a fix for CVE-2026-12385?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-12385 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-12385?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A sensitive information exposure vulnerability exists in Smart Slider 3 due to improper access controls on the 'keyword' parameter within its AJAX content handling. Authenticated attackers with at least 'Contributor' privileges can exploit this by obtaining a security nonce from the standard WordPress post-creation page. By supplying this nonce to the vulnerable component, an attacker can query and retrieve titles and excerpts for posts they do not have permission to view, including drafts and private posts from Administrators. The issue is addressed in versions following 3.5.1.37.

Affected products

Nextendweb Smart Slider 3 up to, and including, 3.5.1.37

Timeline

2026-07-13: advisory
2026-07-13: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.