{"id":"CVE-2026-109381","title":"Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter","summary":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_o…","severity":"high","cvss":7.2,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","cwe":["CWE-269"],"vendor":"magepeopleteam","product":"Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar","affected":["event_booking_manager_for_woocommerce_sell_tickets_event_registration_rsvp_event_calendar <= 5.7.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-28T14:58:25.891058Z"},"published":"2026-10-28","updated":"2026-10-28","sourceUpdated":"2026-10-28T16:10:34.580Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-109381","references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076607ec-d848-4b4e-986b-31287f8f0ae4?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L504"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L432"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L405"},{"url":"https://github.com/magepeopleteam/mage-eventpress"},{"url":"https://plugins.trac.wordpress.org/changeset/3754150/mage-eventpress/trunk/woocommerce-event-press.php"}],"tags":["cve.org"],"epss":0.00431,"epssPercentile":0.37254,"ingestedAt":"2026-10-28T07:06:27.129Z","slug":"CVE-2026-109381","body":"## Overview\n\nThe Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.\n\n## Affected\n\n- `event_booking_manager_for_woocommerce_sell_tickets_event_registration_rsvp_event_calendar <= 5.7.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":40,"depthScoreParts":{"impact":39.6,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}