Mage - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/mage/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioWed, 28 Oct 2026 08:27:05 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMage Eventpress: Privilege escalation via mep_grant_shop_manager_access (CVE-2026-109381)https://feed.craftedsignal.io/briefs/2026-10-mage-eventpress-priv-esc/Wed, 28 Oct 2026 08:27:05 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-mage-eventpress-priv-esc/The Mage Eventpress WordPress plugin is vulnerable to privilege escalation in versions 5.7.8 and earlier due to improper request parameter validation in the mep_grant_shop_manager_access function.The Mage Eventpress plugin for WordPress (versions 5.7.8 and earlier) contains a flaw in the mep_grant_shop_manager_access() function. This function hooks into user_has_cap and unconditionally grants the manage_options capability to users when a request parameter (specifically $_GET['page']) begins with 'mep_' or 'mpwem_'. Because this parameter is not validated against registered plugin screens, authenticated users with Shop Manager-level access can elevate their privileges to Administrator by appending malicious parameters to administrative URL paths.

Impact

Successful exploitation allows authenticated attackers with Shop Manager privileges to achieve full Administrator access, resulting in complete control over the WordPress instance.

Recommendation

  • Update the Mage Eventpress plugin to the latest patched version immediately.
  • Audit existing administrator accounts for unauthorized additions or modifications if the plugin was installed during the period of exposure.
  • Implement access control monitoring for administrative role assignments within the WordPress environment.
]]>highadvisorywordpressprivilege-escalationwebserver