Vulnerability · Published Oct 21, 2026 · Assigned by WPScan
CVE-2026-107506Simple Banner < 3.3.3 - Authenticated Privilege Escalation via User Permissions Setting
High 7.5
In plain English
A high-severity privilege mismanagement in Simple Banner from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 25% of all known vulnerabilities).
Severity (CVSS 3.1)7.5High
Exploit odds (30 days)0.3%top 74.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Simple Banner | 0 – before 3.3.3 |
Weakness: CWE-269 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- https://wpscan.com/vulnerability/8123f94c-0f46-4123-ae13-c2d5474476b2/ exploit, vdb-entry, technical-description