CVE-2024-3027 is an improper authorization vulnerability (CWE-285) in the Smart Slider 3 plugin for WordPress. The issue arises from a missing capability check on the upload function, permitting authenticated users with contributor-level privileges or above to upload arbitrary files, including SVGs. This can lead to stored cross-site scripting attacks due to the nature of SVG files. The vulnerability affects all versions up to and including 3.5.1.22. No official patch or remediation details are provided in the available data.

An attacker with contributor-level or higher access can upload files without proper authorization checks, potentially leading to stored cross-site scripting attacks. This can compromise the integrity and confidentiality of the affected WordPress site by executing malicious scripts in the context of users viewing the uploaded content. There is no indication of availability impact or known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and consider disabling or limiting the use of the Smart Slider 3 plugin upload functionality. Monitor vendor channels for updates and apply patches promptly once released.