CVE-2026-34424: Smart Slider 3 Pro Supply-Chain Backdoor Toolkit for WordPress and Joomla
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla is described as carrying a multi-stage remote access toolkit delivered through a compromised update system. The description says it enables unauthenticated code execution and persistence, and the record rates it critical with CVSS 3.1 score 9.8. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.
Overview
The record describes Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla as delivering a multi-stage remote access toolkit through a compromised update system. The record classifies the issue under CWE-506 (embedded malicious code). Vendor and third-party advisories are listed in the references, including the Patchstack malware analysis.
Impact
- According to the description, unauthenticated attackers could execute arbitrary code and commands.
- The toolkit is described as enabling hidden administrator accounts, theft of credentials and access keys, and persistence through must-use plugins and core file changes.
- The record rates the issue critical: CVSS 3.1 base score 9.8 and CVSS 4.0 score 9.3, both provided by VulnCheck.
Affected products and versions
- The product and version described are Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla.
- The record's affected and fixes lists are empty, so the full range of affected builds and any fixed release cannot be determined from this record. Review the vendor advisories: Joomla advisory and WordPress advisory.
Exploitation status
- The CISA KEV catalog does not list this CVE according to the record (kev.listed is false).
- No confirmed exploitation appears in the sources consulted for this analysis.
- The record includes an EPSS probability of 0.00974 and a percentile of 0.61087.
Remediation and mitigation
- Identify any installation running Smart Slider 3 Pro 3.5.1.35 and follow the vendor advisories for the recommended update or replacement path.
- Treat any installation of that version as potentially compromised until it has been checked: review must-use plugin locations, verify core file integrity against trusted copies, and audit administrator accounts.
- Rotate passwords, API keys and other secrets that were stored on or accessible from the affected site.
- Obtain plugin and extension packages only from trusted sources and verify them before installation.
Detection guidance
- Review administrator user lists for unknown or recently created accounts.
- Compare core and plugin files with trusted copies and look for unexpected files or modifications, especially in must-use plugin locations.
- Review web server and application logs for unusual requests, and check for unexpected outbound connections from the web server.
- The record does not provide technical indicators of compromise, so detection relies on general integrity and account review.
Limitations of the available information
- The record has no CWE name, no affected version range, no fixed version and no vendor-provided technical indicators.
- The source status is marked Deferred in the record.
- Technical details come from the record description and the listed references; they were not independently verified in this analysis.
Frequently asked questions
Is this vulnerability being actively exploited?
The record shows CISA KEV listed as false, and no confirmed exploitation appears in the sources consulted. Treat affected installations as a priority to check anyway, given the described backdoor functionality.
What should administrators do first?
Identify any installation of Smart Slider 3 Pro 3.5.1.35, follow the vendor advisories, review administrator accounts and must-use plugin locations, verify core file integrity, and rotate secrets stored on the site.
This analysis was drafted with AI assistance from verified source data and automatically checked against it.