CVE-2026-34424 affects Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla. The product's update mechanism was compromised to embed a multi-stage remote access toolkit. This allows unauthenticated attackers to execute arbitrary code remotely by sending specially crafted HTTP headers. The attackers can establish persistent backdoors that accept arbitrary PHP code or OS commands, create hidden admin accounts, and exfiltrate sensitive credentials and access keys. Persistence is maintained through multiple injection points including must-use plugins and core file modifications. The vulnerability has a critical CVSS 4.0 score of 9.3, reflecting its high impact and ease of exploitation. No official remediation or patch is currently documented.

The vulnerability enables unauthenticated remote code execution, allowing attackers to fully compromise affected systems. Attackers can gain persistent backdoor access, create hidden administrator accounts, and exfiltrate sensitive credentials and access keys. This can lead to complete system takeover, data breaches, and long-term persistence within the environment. The critical CVSS score (9.3) reflects the high severity and potential impact of this vulnerability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, affected users should consider disabling or uninstalling Smart Slider 3 Pro version 3.5.1.35 and monitoring for suspicious activity related to unauthorized code execution or new administrator accounts. Review and harden update mechanisms and verify the integrity of installed plugins. Avoid using the affected version in production environments until remediation is confirmed.