Floating servers exposed by WordPress flaws and AI malware threats.

Daily Cybersecurity News - March 29, 2026

Written by:Daily Cyber Briefing TeamVerified by:Kirill Gavrilenko

March 29, 2026 5:26 PM 2 min read

WordPress Plugin Flaw Exposes Server Files

Medium

Executive Summary

A critical vulnerability, identified as CVE-2026-3098, has been discovered in the Smart Slider 3 WordPress plugin, allowing authenticated users with subscriber-level permissions to read arbitrary files from the server. The flaw is patched, and administrators are urged to update immediately to prevent potential data theft and website takeover.

Vulnerability Details

Affected Product: Smart Slider 3 plugin for WordPress (versions up to and including 3.5.1.33)
Identifier: CVE-2026-3098
CVSS Score: 6.5 (Medium)
Exploitation Status: Not Actively Exploited (as of late March 2026)

Risk & Impact

Triage: High. Immediate patching is required, especially for sites with open user registration.
Attack Vector: An authenticated attacker with at least subscriber-level permissions can exploit a missing authorization check in the `actionExportAll` AJAX function to download sensitive files, such as `wp-config.php`, which contains database credentials.
Ease of Exploit: Low. The exploit only requires a low-privileged user account, which can be easily created on sites that allow public registration.

Action Plan

Immediate Action: Upgrade the Smart Slider 3 plugin to the patched Version 3.5.1.34 or later.
Workaround: If immediate patching is not possible, consider using a web application firewall (WAF) to create rules that block requests to the vulnerable AJAX action (`actionExportAll`).
Detection: Monitor web server logs for unusual or frequent requests to the plugin's export functionality, especially from low-privileged users.

Relevant professional terms

Arbitrary File Read: A type of vulnerability that allows an attacker to read files on the server that they should not have access to. This can expose sensitive data like configuration files, source code, or system credentials.
Subscriber-level User: The lowest permission level for a logged-in user in a standard WordPress installation. These users typically only have rights to manage their own profile, making it a significant security risk when they can access higher-level functions.

Source: BleepingComputer

AI Tools Supercharge Malware Creation

Executive Summary

AI-powered development tools have matured to the point where a single developer can create sophisticated, modular malware like the VoidLink framework in a compressed timeframe. This marks a significant shift in the threat landscape, lowering the barrier for creating advanced cyber weapons.

Key Findings

AI-assisted malware development has achieved operational maturity, enabling rapid creation of sophisticated tools.
A new modular malware framework, VoidLink, was engineered by a single developer using a commercial AI-powered IDE.
VoidLink is a cloud-native framework designed to target Linux systems, including containerized environments like Docker and Kubernetes.

The Bottom Line

The era of solo developers rivaling state-level threat capabilities has arrived. This democratization of advanced malware creation means security leaders can no longer attribute sophisticated threats solely to large, well-funded groups. The talent pool for dangerous actors has exponentially expanded, requiring a fundamental reassessment of threat models and a greater focus on behavior-based detection.

Relevant Terms

Modular Malware: Malware designed with interchangeable components (modules), allowing an attacker to easily add or remove functionalities like data theft or spyware.
AI-Powered IDE: An Integrated Development Environment that uses artificial intelligence to assist developers by autocompleting code, identifying errors, and accelerating the development process.

Source: Check Point Research