Smart Slider 3 Pro Hit by Sophisticated Multi-Stage Attack

A severe supply chain compromise affecting Smart Slider 3 Pro for WordPress and Joomla has been detailed by CVE Notify. The vulnerability, tracked as CVE-2026-34424, impacts version 3.5.1.35 and allows unauthenticated attackers to achieve remote code execution. The attack chain is particularly nasty, beginning with a compromised update system that injects a multi-stage remote access toolkit. This toolkit enables attackers to bypass authentication and gain a foothold on affected systems.

According to CVE Notify, the exploit goes far beyond simple code execution. Attackers can establish persistent backdoors capable of accepting arbitrary PHP code or OS commands, create hidden administrator accounts, steal sensitive credentials and access keys, and maintain their presence by modifying core files and injecting code into must-use plugins. This level of access and persistence poses a significant risk to website owners running the vulnerable plugin.