Live › vulnerability › CVE-2026-107506
Go to dashboardThe Simple Banner WordPress plugin before 3.3.3 grants roles that an administrator allows to manage banners the full administrator capability. A user in such a low-privileged role can escalate privileges and take over the whole WordPress site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Sites running Simple Banner before 3.3.3 where an administrator has delegated banner management to a non-administrator role. Sites without the plugin, or without delegated banner roles, are not exposed by this flaw as described in the source.
No product ranges from the sources yet.
wp plugin get simple-banner --field=version3.3.3 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
This page as .md · .json · in your agent: get_signal("CVE-2026-107506")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.