# CRITICAL: Smart Slider 3 Pro 3.5.1.35 is a COMPROMISED build - treat this site as HACKED [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-34424 CVE-2026-34424CriticalCVSS 9.3CVE published 9 April 2026Added to mySites.guru 8 April 2026 # CRITICAL: Smart Slider 3 Pro 3.5.1.35 is a COMPROMISED build - treat this site as HACKED The Smart Slider 3 Pro 3.5.1.35 release for Joomla is a malicious build pushed through a breach of the Nextend update infrastructure. Any Joomla site that installed this version must be treated as fully compromised: the payload creates hidden Super User accounts (typically usernames beginning wpsvc\_), drops backdoor files at /cache/cf\_check.php and /media/cf\_check.php, allows remote code execution and exfiltrates credentials. Update to Smart Slider 3 Pro 3.5.1.36 immediately, manually remove any wpsvc\_ Super Users, delete the cf\_check.php backdoor files, reinstall Joomla core and every extension from clean sources, and rotate every credential (Joomla admins, FTP, database, hosting and email). Also within this rule: CVE-2026-34424 (NVD record for this same compromised 3.5.1.35 build). Copy citation ## Is my site affected? - **Affected** - Smart Slider 3 Pro version 3.5.1.35 only - **Fixed in** - No fixed release recorded - **What to do** - We have no fixed release recorded for this range. Check the vendor's release notes for one, and disable Smart Slider 3 Pro if none covers it. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-34424 is scored The base metrics as VulnCheck CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 9.3 Critical CVSS 4.0, scored by VulnCheck CNA `CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **AT:N Attack requirements** - None. Works against any affected install - **PR:N Privileges required** - None. No account needed - **UI:N User interaction** - None. Nobody has to be tricked into anything ### What it does to the site - **VC:H Confidentiality** - High. Everything the site holds can be read - **VI:H Integrity** - High. Data and files can be altered at will - **VA:H Availability** - High. The site can be taken down ### What it does beyond the site - **SC:N Confidentiality** - None. Other systems keep their data - **SI:N Integrity** - None. Other systems keep their integrity - **SA:N Availability** - None. Other systems stay up ## Timeline 1. 8 April 2026mySites.guru check added for Smart Slider 3 Pro (version 3.5.1.35 only) 2. 8 April 2026[We published: Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise](https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/) 3. 9 April 2026CVE-2026-34424 record published by its CNA ## Rule details Critical[CVE-2026-34424](https://mysites.guru/vulnerabilities/CVE-2026-34424/)2026-04-08 [Smart Slider 3 Pro](https://mysites.guru/vulnerabilities/smartslider3/) Affected versions: exactly 3.5.1.35 Full advisory: [our disclosure post](https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/) ## Our disclosure post [![Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise](https://mysites.guru/_astro/smart-slider-3-pro-supply-chain-compromise.COII-DFF_dCxiy.webp) ### Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise Smart Slider 3 Pro 3.5.1.35 was a malicious release pushed through the official update channel. RCE backdoor, hidden admin users. Update to 3.5.1.36. 8 Apr 2026 ](https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/) ## References - [CVE-2026-34424 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-34424) - [CVE-2026-34424 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-34424) - [Smart Slider 3 Pro 3.5.1.35 Was a Malicious Release: Supply Chain Compromise](https://mysites.guru/blog/smart-slider-3-pro-supply-chain-compromise/) ## CVE-2026-34424 questions Show all Which versions are affected by CVE-2026-34424? [CVE-2026-34424](https://mysites.guru/vulnerabilities/CVE-2026-34424/) affects Smart Slider 3 Pro version 3.5.1.35 only. How do I fix CVE-2026-34424? We have no fixed release recorded for this range. Check the vendor's release notes for one, and disable Smart Slider 3 Pro if none covers it. How severe is CVE-2026-34424? VulnCheck CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.