Privilege Escalation in Mage Eventpress Plugin for WordPress
CVE-2026-109381

7.2HIGH

Key Information:

Vendor

WordPress
Status
Event Booking Manager For WooCommerce – Sell Tickets, Event Registration, Rsvp & Event Calendar
Vendor
CVE Published:
28 October 2026

What is CVE-2026-109381?

The Mage Eventpress plugin for WordPress allows authenticated users with Shop Manager-level access to gain Administrator privileges through a vulnerability in the mep_grant_shop_manager_access() function. This function improperly grants manage_options capability based on an unvalidated request marker, specifically when the request includes specific parameters starting with 'mep_' or 'mpwem_'. Attackers can exploit this flaw by modifying core admin URLs, leading to unauthorized access and potential site compromise.

Affected Version(s)

Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar 0 <= 5.7.8

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/mage-eventpres...
https://plugins.trac.wordpress.org/browser/mage-eventpres...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Wordfence PRISM
.