Exploitation observed; activity peaked at 4 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows unauthenticated attackers to execute arbitrary code and commands. Attackers can trigger pre-authentication remote shell execution via HTTP headers, establish authenticated backdoors accepting arbitrary PHP code or OS commands, create hidden administrator accounts, exfiltrate credentials and access keys, and maintain persistence through multiple injection points including must-use plugins and core file modifications.
Priority
HIGH
Exploitation
ACTIVE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-04-09 | 4 | Active Exploitation1Disclosure2Patch1 |
| 2026-04-10 | 1 | Disclosure1 |
| 2026-04-13 | 1 | Active Exploitation1 |
🚨 CVE-2026-34424 — CVSS 9.8/10 ██████████ Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected... Severity: CRITICAL Patch now. #cybersecurity #CVE https://t.co/qaLF59vfk5
Post summary
The tweet announces CVE-2026-34424 as a critical vulnerability in Smart Slider 3 Pro, describes a remote-access toolkit injected into the plugin and urges users to apply a patch.
⚠️ CISA KEV — CVE-2026-34424 Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected throu... CVSS 9.8 · Actively exploited in the wild 🔗 http://ctiwatch.cloud/vulnerabilities/CVE-2026-34424 #CISA #KEV #Vulnerability #CyberSecurity
Post summary
CVE‑2026‑34424 in Smart Slider 3 Pro is a high‑severity vulnerability (CVSS 9.8) that includes a multi‑stage remote access toolkit and is actively exploited in the wild.
CVE-2026-34424 Smart Slider 3 Pro version 3.5.1.35 for WordPress and Joomla contains a multi-stage remote access toolkit injected through a compromised update system that allows una… https://www.cve.org/CVERecord?id=CVE-2026-34424
Post summary
The post announces CVE‑2026‑34424 affecting Smart Slider 3 Pro, noting a multi‑stage remote access toolkit embedded via a compromised update system.
[CVE-2026-34424: CRITICAL] Critical vulnerability in Smart Slider 3 Pro 3.5.1.35 for WordPress and Joomla allows attackers to execute arbitrary code. Update immediately to protect against remote access threats.#cve,CVE-2026-34424,#cybersecurity https://cvefind.com/CVE-2026-34424
Post summary
The post announces a critical arbitrary code execution vulnerability in Smart Slider 3 Pro and urges users to update immediately as a mitigation.
🚨 CRITICAL: CVE-2026-34424 (CVSS 9.8) Smart Slider 3 Pro v3.5.1.35 compromised via update system. Unauthenticated RCE, backdoors, credential theft. WordPress & Joomla users: Remove immediately. #CVE #Vulnerability #PatchNow #ThreatIntel https://t.co/r2c2lxNZXn
Post summary
CVE-2026-34424 is a critical, unauthenticated RCE vulnerability in Smart Slider 3 Pro v3.5.1.35 that is actively exploited via the update system, resulting in backdoors and credential theft; WordPress and Joomla users are urged to remove the plugin immediately.
🚨 CVE-2026-34424: Smart Slider 3 Pro 3.5.1.35 Supp... Supply chain poisoning with pre-auth RCE via HTTP headers—this isn't just a plugin compromise, it's a masterclass in pe... https://zerodaysignal.com/vulnerability/CVE-2026-34424 #netsec #vulnerability #CVE #sysadmin #zeroday
Post summary
The post discloses a new supply‑chain poisoning vulnerability (CVE‑2026‑34424) affecting Smart Slider 3 Pro, detailing a pre‑authentication remote code execution vector through HTTP headers, but no PoC, exploit, or patch is referenced.