CVE-2026-9197 is a directory traversal vulnerability (CWE-22) in the Smart Slider 3 WordPress plugin affecting all versions up to 3.5.1.36. The issue exists in the replaceHTMLImage function and enables authenticated attackers with administrator or higher privileges to read arbitrary server files. This can lead to disclosure of sensitive information stored on the server. The vulnerability requires high privileges to exploit and does not impact integrity or availability. No known exploits are reported in the wild as of the published date.

An attacker with administrator-level access can exploit this vulnerability to read arbitrary files on the server. This could lead to exposure of sensitive information such as configuration files, credentials, or other private data. The vulnerability does not allow code execution or denial of service but compromises confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict administrator access to trusted users only and monitor for suspicious activity. Avoid exposing sensitive files unnecessarily on the server.