# Simple Banner <= 3.3.2 - Authenticated (Subscriber+) Privilege Escalation via User Permissions Setting

- **ID:** WPSEC-2026-1108
- **Plugin:** Simple Banner – Easily add multiple Banners/Bars/Notifications/Announcements to the top or bottom of your website (`simple-banner`), https://wordpress.org/plugins/simple-banner/
- **Affected versions:** all versions before 3.3.3
- **Fixed in:** 3.3.3 (Update to 3.3.3 or later.)
- **Severity:** High 7.5 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H)
- **Weakness:** CWE-269
- **Usage among sites WPSec scans:** plugin Medium, affected versions Medium (as of 2026-10-16)
- **Attack surface analysis:** https://attacksurface.wpsec.com/plugin/simple-banner
- **Fix released:** 2026-10-15
- **Published:** 2026-10-16
- **URL:** https://wpsec.com/vuln/WPSEC-2026-1108/

## Description

The Simple Banner plugin for WordPress is vulnerable to Privilege Escalation via the User Permissions setting in all versions up to, and including, 3.3.2, due to the plugin adding the core 'manage_options' capability to every role selected in its 'permissions_array' setting, instead of only a plugin-specific capability. This makes it possible for authenticated attackers whose role has been given Simple Banner access, which can include subscribers, to update arbitrary site options such as 'default_role' and 'users_can_register' and so gain administrator access. Exploitation requires an administrator to have selected the attacker's role in the plugin's User Permissions setting, which is available when the Pro license is active.

## References

- https://wpsec.com/vuln/WPSEC-2026-1108/
- https://plugins.svn.wordpress.org/simple-banner/tags/3.3.3/
- https://wordpress.org/plugins/simple-banner/

Source: WPSec, https://wpsec.com/vuln/WPSEC-2026-1108/

License: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to use, share and adapt, also commercially, if you credit WPSec and link to this advisory.