{"id":"CVE-2026-109381","kind":"vulnerability","aliases":["CVE-2026-109381"],"related":[],"title":"WordPress Mage Eventpress plugin: shop managers can escalate to administrator","description":"The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.","summary":"The Mage Eventpress WordPress plugin up to and including 5.7.8 grants the manage_options capability whenever a request parameter named page starts with mep_ or mpwem_, without checking that the screen exists. An authenticated user with Shop Manager access or higher can append ?page=mep_x to a core admin URL and become an Administrator.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","woocommerce","wordpress","wordpress-plugin"],"not_affected_if":["no-shop-manager-users","patched-version","plugin-not-installed"],"how_to_check":"- Check the installed version of the Mage Eventpress plugin in the WordPress admin plugins list; versions `5.7.8` and below are affected\n- Look for the function `mep_grant_shop_manager_access` in the plugin's files","fix":"- Update the Mage Eventpress plugin to a version later than `5.7.8`\n- Until updated, deactivate the plugin or restrict Shop Manager accounts\n- Review Administrator accounts for unexpected additions","status":"open","published_at":"2026-10-28T07:16:44+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","triaged_at":"2026-10-28T07:32:49+00:00","updated_at":"2026-10-28T07:32:49+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T07:32:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Mage Eventpress plugin to a version later than `5.7.8`\n- Until updated, deactivate the plugin or restrict Shop Manager accounts\n- Review Administrator accounts for unexpected additions","reach":"internet","title":"WordPress Mage Eventpress plugin: shop managers can escalate to administrator","impact":"high","summary":"The Mage Eventpress WordPress plugin up to and including 5.7.8 grants the manage_options capability whenever a request parameter named page starts with mep_ or mpwem_, without checking that the screen exists. An authenticated user with Shop Manager access or higher can append ?page=mep_x to a core admin URL and become an Administrator.","category":"package","nicknames":[],"who_cares":["wordpress","wordpress-plugin","woocommerce"],"confidence":0.8,"needs_auth":"yes","worst_case":"A shop manager becomes a site administrator and can run code.","analyst_note":"Fixed version not stated in the sources; confirm the first patched release on the NVD or plugin changelog page.","how_to_check":"- Check the installed version of the Mage Eventpress plugin in the WordPress admin plugins list; versions `5.7.8` and below are affected\n- Look for the function `mep_grant_shop_manager_access` in the plugin's files","needs_analyst":true,"not_affected_if":["plugin-not-installed","patched-version","no-shop-manager-users"],"who_is_affected":"Sites running the Mage Eventpress plugin at version 5.7.8 or below that also have users with Shop Manager or higher roles. Sites without the plugin, or with it at a later version, are not affected.","user_interaction":"no","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000648,"input_tokens":3434,"output_tokens":610,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-109381':13A,16A '-2026':12A,15A '5.7.8':32B,95C 'access':61B,105C,155C 'actual':139C 'admin':72B,171C 'administr':10A,77B,163C 'append':65B,165C 'attack':119C,149C 'attacker-control':118C 'authent':56B,148C 'becom':75B 'cap':110C 'capabl':37B 'check':50B 'control':120C 'core':71B,170C 'cve':11A,14A 'due':98C 'elev':159C 'escal':8A,88C 'eventpress':3A,25B,80C,141C 'exist':54B 'function':106C 'general':175C 'get':126C 'grant':33B,102C,113C 'higher':63B 'hook':107C 'includ':31B,94C 'level':154C 'mage':2A,24B,79C 'make':144C 'manag':6A,35B,60B,104C,114C,153C 'manager-level':152C 'marker':122C 'match':123C 'mep':46B,67B,101C,130C,167C 'mpwem':48B,132C 'name':42B 'never':135C 'notabl':125C 'option':36B,115C,174C 'options-gener':173C 'packag':17B 'page':43B,66B,127C,166C 'paramet':41B 'plugin':4A,22B,27B,81C 'possibl':146C 'privileg':87C,161C 'regist':140C 'request':40B,121C 'screen':53B,142C 'shop':5A,59B,103C,151C 'start':44B,128C 'uncondit':112C 'url':73B,172C 'user':57B,108C 'valid':136C 'version':90C 'vulner':85C 'whenev':38B,116C 'without':49B 'woocommerc':18B 'wordpress':1A,19B,21B,26B,83C 'wordpress-plugin':20B 'x':68B,168C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Mage Eventpress plugin at version 5.7.8 or below that also have users with Shop Manager or higher roles. Sites without the plugin, or with it at a later version, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T07:16:44+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-109381","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-109381","severity":null,"published_at":"2026-10-28T07:16:44+00:00","modified_at":"2026-10-28T07:16:44+00:00","first_seen_at":"2026-10-28T07:31:37+00:00","fetched_at":"2026-10-28T07:31:37+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}