Event Booking Manager For Woocommerce Sell Tickets Event Registration Rsvp Event Calendar
Monthly
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.
Privilege escalation in Mage Eventpress (Event Booking Manager for WooCommerce) versions up to and including 5.7.8 allows an authenticated WooCommerce Shop Manager to elevate to Administrator. The mep_grant_shop_manager_access() function hooks user_has_cap and grants manage_options whenever an attacker-controlled $_GET['page'] value begins with 'mep_' or 'mpwem_', without validating that the page is a registered EventPress screen; deployments that assign Shop Manager accounts to non-administrators are exposed. The CVSS 3.1 score is 7.2 with PR:H, reflecting the need for an existing elevated account, and no public exploit identified at time of analysis; vuln.today assigns this CVE a this_week priority.