The Simple Banner WordPress plugin controls which WordPress user roles may manage banners. In versions prior to 3.3.3 the capability management logic is faulty, granting all user roles that the administrator gives permission the full administrator capability. As a result, a low‑privileged user can elevate to an administrator and fully compromise the site, violating confidentiality, integrity, and availability. The weakness lies in improper privilege management and missing authorization controls.

Simple Banner WordPress plugin, versions earlier than 3.3.3, installed on any WordPress site that has configured the plugin to grant banner‑management permissions to non‑administrator roles. The vulnerability is independent of specific host hardware or operating system.

The attack requires only an authenticated WordPress user and the plugin installed. An attacker with a non‑administrator role that has been granted banner‑management rights can obtain administrator privileges through the plugin’s misconfigured capability mapping. The EPSS score is unavailable and the issue is not listed in CISA KEV, but because the impact is a full privilege escalation on a web application, the risk remains high. The CVSS score is not provided, but the exploitability is straightforward once credentials exist, making this an actionable vulnerability for site operators.