CVE-2026-9197 is a directory traversal vulnerability (CWE-22) in the Smart Slider 3 plugin for WordPress, affecting all versions up to and including 3.5.1.36. The vulnerability exists in the replaceHTMLImage function and allows authenticated attackers with administrator-level privileges to read arbitrary files on the server. This can lead to exposure of sensitive information stored in those files. The vulnerability has a CVSS 3.1 base score of 4.9 (medium severity), with network attack vector, low attack complexity, high privileges required, no user interaction, and impacts confidentiality only. There is no vendor advisory or patch information available at this time.

An attacker with administrator-level access can exploit this vulnerability to read arbitrary files on the server, potentially exposing sensitive information. The vulnerability does not affect integrity or availability of the system. Since exploitation requires high privileges, the risk is limited to trusted users who have already gained elevated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrator access to trusted users only and monitor for suspicious activity related to file access within the plugin. No official patch or temporary fix has been documented at this time.