{"id":"CVE-2026-107506","kind":"vulnerability","aliases":["CVE-2026-107506"],"related":[],"title":"Simple Banner WordPress plugin: low-privilege roles gain full administrator rights","description":"The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.","summary":"The Simple Banner WordPress plugin before 3.3.3 grants roles that an administrator allows to manage banners the full administrator capability. A user in such a low-privileged role can escalate privileges and take over the whole WordPress site.","severity":"high","cvss":7.5,"epss":0.00252,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","self-hosted","shared-hosting","wordpress"],"not_affected_if":["no-delegated-banner-roles","plugin-not-installed"],"how_to_check":"- Check the installed version of Simple Banner in the WordPress admin plugins list or `wp plugin get simple-banner --field=version`\n- Review which roles were given banner management rights in the plugin settings and look for unexpected administrator-level accounts","fix":"- Update Simple Banner to `3.3.3` or later\n- Review user accounts and remove any unexpected administrator-level access granted through banner management roles","status":"open","published_at":"2026-10-21T06:16:46+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","triaged_at":"2026-10-25T03:17:02+00:00","updated_at":"2026-10-25T03:17:02+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-25T03:17:02Z","model":"claude-haiku-5-5","output":{"fix":"- Update Simple Banner to `3.3.3` or later\n- Review user accounts and remove any unexpected administrator-level access granted through banner management roles","reach":"internet","title":"Simple Banner WordPress plugin: low-privilege roles gain full administrator rights","impact":"high","summary":"The Simple Banner WordPress plugin before 3.3.3 grants roles that an administrator allows to manage banners the full administrator capability. A user in such a low-privileged role can escalate privileges and take over the whole WordPress site.","category":"package","nicknames":[],"who_cares":["wordpress","self-hosted","shared-hosting"],"confidence":0.8,"needs_auth":"yes","worst_case":"low-privilege user gains full administrator rights and controls the site","analyst_note":"Confirm the fixed version and whether a public advisory or changelog names the affected role setting; sources gave no patch details beyond 3.3.3.","how_to_check":"- Check the installed version of Simple Banner in the WordPress admin plugins list or `wp plugin get simple-banner --field=version`\n- Review which roles were given banner management rights in the plugin settings and look for unexpected administrator-level accounts","needs_analyst":true,"not_affected_if":["plugin-not-installed","no-delegated-banner-roles"],"who_is_affected":"Sites running Simple Banner before `3.3.3` where an administrator has delegated banner management to a non-administrator role. Sites without the plugin, or without delegated banner roles, are not exposed by this flaw as described in the source.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000621,"input_tokens":3358,"output_tokens":571,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-107506':15A,18A '-2026':14A,17A '3.3.3':33B,72C 'administr':11A,38B,45B,86C,97C 'allow':39B,87C,100C 'banner':2A,29B,42B,68C,91C 'capabl':46B,78C,98C 'compromis':114C 'correct':75C 'cve':13A,16A 'escal':57B,109C 'full':10A,44B,96C 'fulli':113C 'gain':9A 'grant':34B,80C,92C 'host':22B,25B 'limit':76C 'low':6A,53B,105C 'low-privileg':5A,52B,104C 'manag':41B,89C 'packag':19B 'plugin':4A,31B,70C 'privileg':7A,54B,58B,106C,111C 'right':12A 'role':8A,35B,55B,84C,94C,107C 'self':21B 'self-host':20B 'share':24B 'shared-host':23B 'simpl':1A,28B,67C 'site':65B,116C 'take':60B 'user':48B,83C,101C 'whole':63B 'wordpress':3A,26B,30B,64B,69C","nicknames":[],"mitigations":[],"who_affected":"Sites running Simple Banner before `3.3.3` where an administrator has delegated banner management to a non-administrator role. Sites without the plugin, or without delegated banner roles, are not exposed by this flaw as described in the source.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T06:16:46+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"134c704f-9b21-4f2e-91b3-4a467353bcc0","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-107506","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-107506","severity":null,"published_at":"2026-10-21T06:16:46+00:00","modified_at":"2026-10-21T18:37:38+00:00","first_seen_at":"2026-10-23T21:57:28+00:00","fetched_at":"2026-10-23T22:29:01+00:00","note":null},{"source":"epss","external_id":"CVE-2026-107506","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-107506","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T13:15:55+00:00","fetched_at":"2026-10-24T13:15:55+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}