Affected versions: exactly 3.5.1.35
Full advisory: our disclosure post
CVE-2026-34424CriticalCVSS 9.3CVE published 9 April 2026Added to mySites.guru 8 April 2026
CRITICAL: Smart Slider 3 Pro 3.5.1.35 is a COMPROMISED build - treat this site as HACKED
The Smart Slider 3 Pro 3.5.1.35 release for Joomla is a malicious build pushed through a breach of the Nextend update infrastructure. Any Joomla site that installed this version must be treated as fully compromised: the payload creates hidden Super User accounts (typically usernames beginning wpsvc_), drops backdoor files at /cache/cf_check.php and /media/cf_check.php, allows remote code execution and exfiltrates credentials. Update to Smart Slider 3 Pro 3.5.1.36 immediately, manually remove any wpsvc_ Super Users, delete the cf_check.php backdoor files, reinstall Joomla core and every extension from clean sources, and rotate every credential (Joomla admins, FTP, database, hosting and email). Also within this rule: CVE-2026-34424 (NVD record for this same compromised 3.5.1.35 build).
Is my site affected?
- Affected
- Smart Slider 3 Pro version 3.5.1.35 only
- Fixed in
- No fixed release recorded
- What to do
- We have no fixed release recorded for this range. Check the vendor's release notes for one, and disable Smart Slider 3 Pro if none covers it.
How CVE-2026-34424 is scored
The base metrics as VulnCheck CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
9.3 Critical
CVSS 4.0, scored by VulnCheck CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
Timeline
- 8 April 2026mySites.guru check added for Smart Slider 3 Pro (version 3.5.1.35 only)
- 8 April 2026We published: Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise
- 9 April 2026CVE-2026-34424 record published by its CNA
Rule details
Our disclosure post
References
- CVE-2026-34424 on cve.org (the official CVE record)
- CVE-2026-34424 in the NIST National Vulnerability Database
- Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise
CVE-2026-34424 questions
Which versions are affected by CVE-2026-34424?
CVE-2026-34424 affects Smart Slider 3 Pro version 3.5.1.35 only.
How do I fix CVE-2026-34424?
We have no fixed release recorded for this range. Check the vendor's release notes for one, and disable Smart Slider 3 Pro if none covers it.
How severe is CVE-2026-34424?
VulnCheck CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.