{"id":"CVE-2026-109381","aliases":["EUVD-2026-111735","GHSA-g289-qjmf-x2p6"],"status":"published","title":"Event Booking Manager for WooCommerce \u003c= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00431,"percentile":0.37779,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-269"],"published":"2026-10-28T06:45:05Z","modified":"2026-10-28T17:17:34Z","products":[{"vendor":"magepeopleteam","product":"event booking manager for woocommerce – sell tickets, event registration, rsvp \u0026 event calendar"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/076607ec-d848-4b4e-986b-31287f8f0ae4?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L504"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L432"},{"url":"https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L405"},{"url":"https://github.com/magepeopleteam/mage-eventpress"},{"url":"https://plugins.trac.wordpress.org/changeset/3754150/mage-eventpress/trunk/woocommerce-event-press.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109381"},{"url":"https://github.com/advisories/GHSA-g289-qjmf-x2p6"}],"sources":{"cve":[{"id":"CVE-2026-109381","title":"Event Booking Manager for WooCommerce \u003c= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","status":"published","published":"2026-10-28T06:45:05.954Z","modified":"2026-10-28T16:10:34.58Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:20:11.581788Z"}],"euvd":[{"id":"EUVD-2026-111735","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","status":"published","published":"2026-10-28T06:45:05Z","modified":"2026-10-28T16:10:34Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T16:59:20.41252Z"}],"ghsa":[{"id":"GHSA-g289-qjmf-x2p6","title":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to,...","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","status":"published","published":"2026-10-28T09:31:54Z","modified":"2026-10-28T09:32:02Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T15:14:32.579072Z"}],"nvd":[{"id":"CVE-2026-109381","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","status":"published","published":"2026-10-28T07:16:44.423Z","modified":"2026-10-28T17:17:34.973Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-269"],"updated_at":"2026-11-02T14:13:04.037468Z"}]}}