CVE-2026-109381: Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

Q: Who can exploit this issue?

An authenticated user with Shop Manager-level access or higher can exploit it. The attack is network-accessible, requires no user interaction, and relies on the attacker being able to send a request to the WordPress admin area.

Q: What does an attacker need to do to gain elevated access?

The attacker can append a page parameter beginning with mep_ or mpwem_ to a core admin URL. The plugin grants manage_options based on that attacker-controlled marker without validating that it corresponds to a registered EventPress screen, enabling elevation to Administrator.

Q: Are only EventPress administration pages affected?

No. The affected capability check can be triggered through core WordPress admin URLs when the page parameter starts with mep_ or mpwem_. The marker is not validated against an actual EventPress administration screen.

Published Oct 28, 2026

Updated

The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mepgrantshopmanageraccess() function hooking userhascap and unconditionally granting manageoptions whenever an attacker-controllable request marker matches — most notably $GET['page'] starting with 'mep' or 'mpwem', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mepx to core admin URLs (options-general.

Affected Software

1 affected component

Mage Eventpress Event Booking Manager for WooCommerce<=5.7.8

Event History

Oct 28, 2026

CVE Published

via MITRE·06:45 AM

Data Sourced

via MITRE·06:45 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Who can exploit this issue?

An authenticated user with Shop Manager-level access or higher can exploit it. The attack is network-accessible, requires no user interaction, and relies on the attacker being able to send a request to the WordPress admin area.

What does an attacker need to do to gain elevated access?

The attacker can append a page parameter beginning with mep_ or mpwem_ to a core admin URL. The plugin grants manage_options based on that attacker-controlled marker without validating that it corresponds to a registered EventPress screen, enabling elevation to Administrator.

Are only EventPress administration pages affected?

No. The affected capability check can be triggered through core WordPress admin URLs when the page parameter starts with mep_ or mpwem_. The marker is not validated against an actual EventPress administration screen.

CVE-2026-109381: Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to gain elevated access?

Are only EventPress administration pages affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What does an attacker need to do to gain elevated access?

Are only EventPress administration pages affected?