CVE-2026-3098 is a missing authorization vulnerability in the Smart Slider 3 WordPress plugin (versions up to 3.5.1.33). The flaw exists in the 'actionExportAll' function, which improperly restricts access, allowing authenticated users with low privileges (Subscriber-level and above) to perform arbitrary file reads on the server. This can lead to exposure of sensitive server files. The vulnerability has a CVSS score of 6.5 (medium severity) with network attack vector, low attack complexity, and no user interaction required.

An attacker with at least Subscriber-level access to a WordPress site using the vulnerable Smart Slider 3 plugin can read arbitrary files on the server. This may lead to disclosure of sensitive information stored in server files. The vulnerability does not allow modification or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict user roles and permissions to trusted users only and monitor for suspicious activity related to the Smart Slider 3 plugin. Avoid granting Subscriber or higher privileges to untrusted users.