Simple Banner CVE-2026-107506

Exploitation requires that a WordPress administrator has used Simple Banner's feature to allow one or more non-administrator roles to manage banners, and that the attacker already holds an account in such a delegated role. This is the specific limiting precondition reflected by AC:H and PR:L: the plugin incorrectly grants the full 'administrator' capability to any role permitted to manage banners, so the flaw is NOT reachable on default installs where no non-admin role has been delegated banner management, nor by fully unauthenticated visitors. The required authenticated low-privilege account plus non-default delegation configuration meaningfully narrow realistic exposure.

This is a genuine privilege-escalation flaw (CWE-269) in the Simple Banner WordPress plugin, confirmed by WPScan with a vendor patch (3.3.3) and publicly available exploit code. The provided CVSS 3.1 vector (AV:N/AC:H/PR:L/UI:N/S:U, C:H/I:H/A:H, score 7.5) indicates network-reachable exploitation by an already-authenticated low-privileged user, with HIGH attack complexity reflecting a non-default precondition rather than a trivially-chainable bug. No CISA KEV listing and no EPSS value were supplied, so there is no evidence of active or widespread exploitation despite the existing POC - these are distinct signals and POC availability must not be read as in-the-wild use. No SSVC decision data was provided. The realistic priority is moderate-to-high where the plugin is deployed AND an administrator has delegated banner management to non-admin roles; absent that delegation the vulnerability is not reachable. Note the signals are internally consistent (AC:H aligns with the description's conditional 'roles an administrator allows to manage its banners'), so this is a real but conditional issue rather than a high-CVSS-but-no-real-risk inflation.

An administrator has configured Simple Banner to let a lower-privileged role (e.g., editor or a custom banner-manager role) manage banners. A user holding that role logs in and leverages the plugin's over-broad capability grant to gain full administrator privileges, then takes over the site (installs a malicious plugin/admin user). Public exploit code referenced by WPScan lowers the effort required.