CVE-2026-4065

CVE-2026-4065 is a privilege escalation vulnerability affecting Smart Slider 3 for WordPress through version 3.5.1.33. The plugin fails to properly validate user capabilities on multiple AJAX controller actions, allowing authenticated attackers with Contributor-level access to bypass security checks and manipulate slider metadata and image storage records. This occurs because the display_admin_ajax() method omits required capability verification, relying instead solely on nonce validation. The vulnerability carries a CVSS v3.1 score of 5.4 (Medium) with a network-based attack vector requiring low complexity and low privilege requirements. The impact is limited to partial confidentiality and integrity compromise without availability impact. The EPSS score of 0.00012 indicates minimal current exploitation probability, ranking it below 0.0166 percent of all CVEs in terms of real-world weaponization likelihood. There is no evidence of active exploitation, as the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The issue remains inactive on security community hot lists, and no public exploit code appears to be widely available. However, organizations running Smart Slider 3 should apply available patches promptly, as the attack complexity is low and requires only standard authenticated access to WordPress.