WordPress: the problem is not the plugin,
it's the architecture

CVE-2026-3098: half a million sites exposed

On 29 March 2026, BleepingComputer published details of CVE-2026-3098, a vulnerability in the Smart Slider 3 plugin for WordPress. The plugin is installed on over 500,000 websites worldwide.

The flaw is an Arbitrary File Read: an authenticated user, even with the lowest role WordPress provides (subscriber), can read any file on the server. No administrator privileges, no developer access, no sophisticated attack techniques required.

The primary target is the wp-config.php file, which contains database credentials, security keys and site configuration parameters. Anyone who obtains this file holds the keys to the entire installation: database, content, administrative accounts — everything.

Not an isolated case: it's a structural pattern

CVE-2026-3098 is not an exception. WordPress powers 43% of all websites and accounts for 90% of all compromised CMS platforms. The problem is not a single vulnerable plugin: it's the architecture itself.

• Exposed database— every WordPress installation has a MySQL database accessible from the server. Credentials are stored in a plain text file on the filesystem.
• Attackable admin panel — /wp-admin is reachable by anyone. Brute-force attacks, credential stuffing and phishing target it constantly.
• Uncontrolled plugin ecosystem— every plugin executes PHP code on the server with the same privileges as the application. A single vulnerable plugin compromises the entire site.
• Patching inertia— management is decentralised, and site operators often lack technical expertise. A known and patched vulnerability can remain exploitable for months or years.

The alternative: change the architecture

The solution is not better hosting or yet another security plugin. It's an architectural change: pre-rendered static sites, distributed via a global CDN, protected by a Web Application Firewall (WAF) and deployed automatically.

A static site has no database, no CMS, no admin panel and no plugins. The attack surface is reduced to near zero. Content is generated at build time and served as HTML files from the CDN closest to the user.

This is the approach we use for our own site and offer to clients through our managed hosting service: Azure infrastructure with App Service or Static Web Apps, Azure Front Door with WAF, global CDN, automatic TLS certificates and deployment from GitHub.

What to do now

If your site uses WordPress:

• 1Update immediately— verify that Smart Slider 3 is updated to version 3.5.1.34 or later. Update all plugins and the WordPress core.
• 2Review your users— audit the list of registered users. Disable registration if it is not necessary. Remove unused accounts.
• 3Check wp-config.php— if you suspect a compromise, change the database credentials and security keys immediately.
• 4Consider migration— if your site is primarily informational (brochure site, landing page, blog), consider migrating to a static architecture. It is more secure, faster and costs less to maintain.