WordPress Smart Slider 3 plugin <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation vulnerability

Missing Authorization to Authenticated Contributor+ Slider Data Read and Image Record Manipulation vulnerability discovered by darkmode in WordPress Plugin Smart Slider 3 versions = 3.5.1.33...

CVE-2026-4065 Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation

The Smart Slider 3 plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on multiple wpajaxsmart-slider3 controller actions in all versions up to, and including, 3.5.1.33. The displayadminajax method does not call checkForCap which...