Simple Banner <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation via User Permissions Setting
- ID
- WPSEC-2026-1108
- Plugin
- Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website (simple-banner)
- Affected
- all versions before 3.3.3
- Remediation
- Update to 3.3.3 or later.
- CVSS 3.1
- CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
- Weakness
- CWE-269
- Usage
- Plugin Medium · Affected versions Medium among sites WPSec scans, 2026-10-16
- Attack surface
- Simple Banner on WPSec AttackSurface
- Fix released
- Published
Description
The Simple Banner plugin for WordPress is vulnerable to Privilege Escalation via the User Permissions setting in all versions up to, and including, 3.3.2, due to the plugin adding the core 'manage_options' capability to every role selected in its 'permissions_array' setting, instead of only a plugin-specific capability. This makes it possible for authenticated attackers whose role has been given Simple Banner access, which can include subscribers, to update arbitrary site options such as 'default_role' and 'users_can_register' and so gain administrator access. Exploitation requires an administrator to have selected the attacker's role in the plugin's User Permissions setting, which is available when the Pro license is active.
References
- https://wpsec.com/vuln/WPSEC-2026-1108/
- https://plugins.svn.wordpress.org/simple-banner/tags/3.3.3/
- https://wordpress.org/plugins/simple-banner/
Published by WPSec. Provided as is, without warranty. Corrections: contact us.
This advisory as JSON or Markdown · All advisories: JSON, RSS