CVE-2026-4065

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wp_ajax_smart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The display_admin_ajax() method does not call checkForCap() (which requires unfiltered_html capability), and several controller actions only validate the nonce (validateToken()) without calling validatePermission(). This makes it possible for authenticated attackers, with Contributor-level access and above, to enumerate slider metadata and create, modify, and delete image storage records by obtaining the nextend_nonce exposed on post editor pages.

• CWE-862

• https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.32/Nextend/Framework/Image/ControllerAjaxImage.php#L37
• https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.32/Nextend/SmartSlider3/Application/Admin/Sliders/ControllerAjaxSliders.php#L26
• https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.32/Nextend/SmartSlider3/Platform/WordPress/Admin/AdminHelper.php#L155
• https://plugins.trac.wordpress.org/browser/smart-slider-3/tags/3.5.1.32/Nextend/SmartSlider3/Platform/WordPress/HelperTinyMCE.php#L30
• https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/Platform/WordPress/Admin/AdminHelper.php#L155
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3489689%40smart-slider-3%2Ftrunk&old=3439582%40smart-slider-3%2Ftrunk&sfp_email=&sfph_mail=
• https://www.wordfence.com/threat-intel/vulnerabilities/id/53a08b59-b7e0-419a-bfc3-528bcddb1ac2?source=cve

Published

Apr 7, 2026

Last Modified

Jul 24, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-40633Dell PowerScale OneFS versions 9.5.0.0 through 9.10.1.7, ver…5.5
• CVE-2026-40636Dell ECS versions 3.8.1.0 through 3.8.1.7 and Dell ObjectSca…7.8
• CVE-2026-40638Dell PowerScale InsightIQ, versions 5.0.0 through 6.2.0, con…6.7
• CVE-2026-40639Dell Client Platform BIOS contains a Weak Encoding for Passw…5.7
• CVE-2026-4064Missing authorization checks on multiple gRPC service endpoi…8.3
• CVE-2026-40641Dell PowerFlex Manager, version(s) prior to 5.1.0.1, contain…4.8
• CVE-2026-4066The Smart Custom Fields plugin for WordPress is vulnerable t…4.3
• CVE-2026-4067The Ad Short plugin for WordPress is vulnerable to Stored Cr…6.4
• CVE-2026-40677The use of insecure HTTP transport within AMD optional tools…7.7
• CVE-2026-4068The Add Custom Fields to Media plugin for WordPress is vulne…4.3
• CVE-2026-40682XML External Entity (XXE) via Unsanitized Dictionary Parsing…9.1
• CVE-2026-40683In OpenStack Keystone before 28.0.1, the LDAP identity backe…7.7