CVE-2026-34424 is a critical vulnerability in Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla, involving embedded malicious code introduced through a compromised update mechanism. This multi-stage remote access toolkit enables unauthenticated attackers to execute arbitrary code and commands remotely, including pre-authentication remote shell execution via HTTP headers. The attackers can establish persistent backdoors that accept arbitrary PHP or OS commands, create hidden admin accounts, exfiltrate sensitive credentials and access keys, and maintain persistence through multiple injection points such as must-use plugins and core file modifications. The vulnerability has a CVSS 4.0 score of 9.3, indicating high impact and exploitability. No patch or official remediation level has been published yet.

The vulnerability allows unauthenticated remote attackers to execute arbitrary code and commands on affected systems, potentially leading to full system compromise. Attackers can create persistent backdoors, hidden administrator accounts, and exfiltrate sensitive credentials and access keys. This can result in unauthorized access, data theft, and long-term persistence on compromised WordPress or Joomla installations running the affected version of Smart Slider 3 Pro.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, consider disabling or removing the affected Smart Slider 3 Pro version 3.5.1.35 plugin from WordPress or Joomla installations to prevent exploitation. Monitor for unusual activity related to backdoors or unauthorized administrator accounts. Avoid applying updates from untrusted sources and verify update integrity.