Live › vulnerability › CVE-2026-109381
Go to dashboardThe Mage Eventpress WordPress plugin up to and including 5.7.8 grants the manage_options capability whenever a request parameter named page starts with mep_ or mpwem_, without checking that the screen exists. An authenticated user with Shop Manager access or higher can append ?page=mep_x to a core admin URL and become an Administrator.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 07:31 UTC. All times on this page are UTC.
Sites running the Mage Eventpress plugin at version 5.7.8 or below that also have users with Shop Manager or higher roles. Sites without the plugin, or with it at a later version, are not affected.
No product ranges from the sources yet.
5.7.8 and below are affectedmep_grant_shop_manager_access in the plugin's files5.7.8Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $GET['page'] starting with 'mep' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
This page as .md · .json · in your agent: get_signal("CVE-2026-109381")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.