Junglewise Threat Intelligence

CVE-2026-4065: Nextendweb Smart Slider 3 missing authorization in AJAX actions

CVE-2026-4065 · Severity: medium · CVSS 5.4 · Published 2026-04-07

Technologies: Nextendweb Smart Slider 3.

Executive brief

Smart Slider 3, a popular WordPress plugin for creating visual sliders, contains a security flaw that allows users with low-level 'Contributor' accounts to access and modify data they should not be able to reach. An attacker could use this to view slider metadata or create, change, and delete image storage records. This could lead to unauthorized content changes or the loss of image data on the affected website.

Technical details

The Smart Slider 3 plugin for WordPress is vulnerable to missing authorization (CWE-862) in its AJAX handlers. Specifically, the display_admin_ajax() method fails to call checkForCap(), and several controller actions validate only the security nonce (validateToken()) without performing a permission check (validatePermission()). An authenticated attacker with Contributor-level permissions or higher can exploit this by obtaining the 'nextend_nonce' from post editor pages. This allows the attacker to enumerate slider metadata and perform CRUD operations on image storage records. The vulnerability is present in all versions up to and including 3.5.1.33.

Affected products

  • Nextendweb Smart Slider 3 up to, and including, 3.5.1.33

Timeline

  • 2026-04-07: disclosed: Initial disclosure by Wordfence
  • 2026-04-07: advisory: NVD publication date

References