---
id: "CVE-2026-107506"
kind: "vulnerability"
aliases: ["CVE-2026-107506"]
title: "Simple Banner WordPress plugin: low-privilege roles gain full administrator rights"
severity: "high"
cvss: 7.5
epss: 0.00252
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["package", "self-hosted", "shared-hosting", "wordpress"]
not_affected_if: ["no-delegated-banner-roles", "plugin-not-installed"]
published_at: "2026-10-21T06:16:46+00:00"
first_seen_at: "2026-10-23T21:57:28+00:00"
updated_at: "2026-10-25T03:17:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107506", "first_seen_at": "2026-10-23T21:57:28+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-107506", "first_seen_at": "2026-10-24T13:15:55+00:00"}]
---

# Simple Banner WordPress plugin: low-privilege roles gain full administrator rights

The Simple Banner WordPress plugin before 3.3.3 grants roles that an administrator allows to manage banners the full administrator capability. A user in such a low-privileged role can escalate privileges and take over the whole WordPress site.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed version of Simple Banner in the WordPress admin plugins list or `wp plugin get simple-banner --field=version`
- Review which roles were given banner management rights in the plugin settings and look for unexpected administrator-level accounts

## Fix

- Update Simple Banner to `3.3.3` or later
- Review user accounts and remove any unexpected administrator-level access granted through banner management roles

## Timeline

- 2026-10-23T21:57:28+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-107506
- 2026-10-24T13:15:55+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-107506

## From the sources

The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_