CVE-2026-107506: Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
Affected Software
Event History
Frequently Asked Questions
Which sites are exposed to privilege escalation?
Sites using a Simple Banner version before 3.3.3 are exposed if an administrator has allowed a lower-privileged role to manage the plugin's banners. Those users may receive the full administrator capability.
What access does an attacker need?
An attacker needs an authenticated account in a low-privileged role that has been allowed to manage Simple Banner banners. They can then escalate to administrator-level access and fully compromise the site.
Are default role configurations affected?
The issue depends on an administrator configuring a user role to manage Simple Banner banners. The provided information does not state that default WordPress role settings grant this access.
How can I determine whether my site may already be affected?
Check whether Simple Banner is below version 3.3.3 and review which non-administrator roles have been allowed to manage its banners. Any users in those roles should be treated as potentially able to obtain administrator capability.