Mage Eventpress CVE-2026-109381

The attacker must already possess an authenticated Shop Manager-level account (or higher but below Administrator) on the target WordPress site - this role is provisioned by WooCommerce, so the site must run WooCommerce alongside the vulnerable Mage Eventpress / Event Booking Manager plugin (versions ≤5.7.8). With that account, exploitation requires only appending a request marker - $_GET['page'] beginning with 'mep_' or 'mpwem_' - to any core admin URL (e.g. options-general.php), because the mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options without validating that the page matches a real EventPress screen. Limiting factors: it cannot be used by unauthenticated or low-privilege (subscriber/customer) users since PR:H requires an existing elevated role, and it only applies to deployments that actually hand Shop Manager accounts to non-administrators; it is not a default-configuration remote-unauthenticated issue.

This is a genuine but access-gated privilege-escalation flaw (CWE-269), not an inflated high-CVSS score. The NVD/Wordfence CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N (base 7.2) is internally consistent with the description: exploitation is trivial once you are in (AC:L - just append ?page=mep_x to an admin URL, no user interaction), but it requires an already-privileged account (PR:H), so the attacker must first hold a Shop Manager-level WordPress/WooCommerce account. Impact is total (C:H/I:H/A:H) because the victim becomes a full Administrator. Decision framework signals point to near-term rather than emergency action: the vuln.today priority label is 'this_week', there is no CISA KEV listing (so no confirmed active exploitation) and no EPSS score is supplied in the input, so widespread opportunistic exploitation cannot be quantified from this data. No SSVC automatable/exploitation values were provided. The practical risk is therefore scoped to environments that provision Shop Manager (or higher, non-admin) accounts to semi-trusted staff; it is an insider/compromised-sub-admin escalation path rather than a remote-unauthenticated internet threat. Note the apparent product-name divergence: the description names 'Mage Eventpress' while the CPE and EUVD name 'Event Booking Manager for WooCommerce …' - these are the same plugin (slug mage-eventpress by magepeopleteam), not a conflict, but worth confirming when matching inventory.

An attacker who already holds a Shop Manager account (for example a WooCommerce store operator, or an account taken over via phishing/credential reuse) browses to a core admin page and appends ?page=mep_x to the URL. The plugin's user_has_cap hook sees the 'mep_' marker and unconditionally grants manage_options, immediately promoting the session to Administrator with full site control. No public working exploit is identified at the time of analysis, though the vulnerable source lines and the fixing changeset are publicly visible on the WordPress plugin trac.