Skip to content
Threat Feed
Subscribe
high advisory

Mage Eventpress: Privilege escalation via mep_grant_shop_manager_access (CVE-2026-109381)

The Mage Eventpress WordPress plugin is vulnerable to privilege escalation in versions 5.7.8 and earlier due to improper request parameter validation in the mep_grant_shop_manager_access function.

CVE search metadata

CVE search record: CVE-2026-109381. Severity: high. CVSS: 7.2. KEV: no. Product: Eventpress (<= 5.7.8). Brief: Mage Eventpress: Privilege escalation via mep_grant_shop_manager_access (CVE-2026-109381). Brief link: https://feed.craftedsignal.io/briefs/2026-10-mage-eventpress-priv-esc/

Triage facts

Revision 1
Applicability
Eventpress (<= 5.7.8)
Evidence
Unknown
Severity
High
Action
Elevated
Sources
1 public source
Freshness
Revision 1Oct 28, 08:27 UTC
Detection
1 rule
Vulnerabilities
1 CVE
Source quality
A1Likely

The Mage Eventpress plugin for WordPress (versions 5.7.8 and earlier) contains a flaw in the mep_grant_shop_manager_access() function. This function hooks into user_has_cap and unconditionally grants the manage_options capability to users when a request parameter (specifically $_GET['page']) begins with 'mep_' or 'mpwem_'. Because this parameter is not validated against registered plugin screens, authenticated users with Shop Manager-level access can elevate their privileges to Administrator by appending malicious parameters to administrative URL paths.

Impact

Successful exploitation allows authenticated attackers with Shop Manager privileges to achieve full Administrator access, resulting in complete control over the WordPress instance.

Recommendation

  • Update the Mage Eventpress plugin to the latest patched version immediately.
  • Audit existing administrator accounts for unauthorized additions or modifications if the plugin was installed during the period of exposure.
  • Implement access control monitoring for administrative role assignments within the WordPress environment.

Immediate actions

Patch Mage Eventpress plugin to a version > 5.7.8

IT Operations 48h

Threat Hunt

Search logs for unauthorized administrative access by accounts with Shop Manager roles.

T1068 medium medium confidence hunt now

Data: WordPress user role assignment logs, Web server access logs

Mitigations

Update Eventpress plugin to patched version

immediate IT Operations

CVE-2026-109381

Detection coverage 1

Detect CVE-2026-109381 Exploitation - Privileged Access Attempt

high

Detects requests to administrative WordPress pages containing the Eventpress plugin specific GET parameters, which may indicate an attempt to exploit the mep_grant_shop_manager_access privilege escalation vulnerability.

sigma tactics: privilege_escalation techniques: T1068 sources: webserver

Detection queries are available on the platform. Get full rules →