CVE-2026-109381highCWE-269

CVE-2026-109381: high-severity vulnerability in magepeopleteam Event Booking Manager for…

Event Booking Manager for WooCommerce <= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to 'page' Parameter

Published

Follow this CVE+ Monitor Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 7.2epss 0.4%
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Affected products
magepeopleteam · Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar
Related CVEs — magepeopleteam Event Booking Manager for…

In the same product, most dangerous first.

CVE-2026-17166MEDIUMEvent Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX ActionEPSS 0.4%