{"id":"CVE-2026-107506","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-107506","generatedAt":"2026-10-28T10:48:21.790Z","title":"The Simple Banner WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a…","description":"The Simple Banner  WordPress plugin before 3.3.3 does not correctly limit the capabilities it grants to the user roles an administrator allows to manage its banners, granting such roles the full administrator capability, which allows users in a low-privileged role to escalate their privileges and fully compromise the site.","published":"2026-10-21T06:16:47.000Z","lastModified":"2026-10-21T18:37:39.000Z","status":"Deferred","sourceIdentifier":"contact@wpscan.com","cvss":{"version":"3.1","score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-269"],"affected":[],"epss":{"score":0.0032,"percentile":0.24795,"date":"2026-10-27","history":[{"date":"2026-10-21","score":0.00148,"percentile":0.03713}]},"kev":{"listed":false},"exploits":{"count":0,"verified":false,"firstPublished":null,"source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[]},"verdict":{"level":"high","text":"High impact if exploited, but EPSS currently rates exploitation as unlikely (0.32%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit."},"changes":[{"kind":"scored","label":"Newly scored","at":"2026-10-21T13:15:08.000Z","detail":{"from":null,"score":"7.5","severity":"HIGH","fromSeverity":null},"summary":"Now scored CVSS 7.5 HIGH."},{"kind":"new","label":"New CVE","at":"2026-10-21T06:16:47.000Z","detail":{"score":null,"severity":null,"publishedAt":"2026-10-21T06:16:46.993Z"},"summary":"New CVE, high severity (CVSS 7.5)."}],"references":[{"url":"https://wpscan.com/vulnerability/8123f94c-0f46-4123-ae13-c2d5474476b2/","source":"contact@wpscan.com"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-107506","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}