Medium severity4.9NVD Advisory· Published Jun 6, 2026· Updated Jun 8, 2026
CVE-2026-9197
CVE-2026-9197
Description
The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
2<=3.5.1.36+ 1 more
- (no CPE)range: <=3.5.1.36
- (no CPE)range: <=3.5.1.36
Patches
Vulnerability mechanics
References
5- plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/Application/Admin/Slider/ControllerSlider.phpnvd
- plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.phpnvd
- plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.phpnvd
- plugins.trac.wordpress.org/changesetnvd
- www.wordfence.com/threat-intel/vulnerabilities/id/059c2d6d-1296-4463-96ae-a95ba7dad70anvd
News mentions
1- Wordfence Intelligence Weekly WordPress Vulnerability Report (June 1, 2026 to June 7, 2026)Wordfence Blog · Jun 11, 2026