Refine your search

2 vulnerabilities found for Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar by magepeopleteam

CVE-2026-109381 (GCVE-0-2026-109381)
Vulnerability from cvelistv5
Published
2026-10-28 06:45
Modified
2026-10-28 16:10
Severity ?
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CWE
  • CWE-269 - Improper Privilege Management
Summary
The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches — most notably $_GET['page'] starting with 'mep_' or 'mpwem_', which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general.
References
Impacted products
Vendor Product Version
magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar Version: 0   ≤ 5.7.8
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-109381",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-28T14:58:25.891058Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-28T16:10:34.580Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP \u0026 Event Calendar",
          "vendor": "magepeopleteam",
          "versions": [
            {
              "lessThanOrEqual": "5.7.8",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Mage Eventpress plugin for WordPress is vulnerable to privilege escalation in versions up to, and including, 5.7.8 This is due to the mep_grant_shop_manager_access() function hooking user_has_cap and unconditionally granting manage_options whenever an attacker-controllable request marker matches \u2014 most notably $_GET[\u0027page\u0027] starting with \u0027mep_\u0027 or \u0027mpwem_\u0027, which is never validated against an actually registered EventPress screen. This makes it possible for authenticated attackers, with Shop Manager-level access and above, to elevate their privileges to Administrator by appending ?page=mep_x to core admin URLs (options-general."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-269",
              "description": "CWE-269 Improper Privilege Management",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-28T06:45:05.954Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/076607ec-d848-4b4e-986b-31287f8f0ae4?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L504"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L432"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/woocommerce-event-press.php#L405"
        },
        {
          "url": "https://github.com/magepeopleteam/mage-eventpress"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset/3754150/mage-eventpress/trunk/woocommerce-event-press.php"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-10-12T14:41:58.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-10-27T17:41:38.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Event Booking Manager for WooCommerce \u003c= 5.7.8 - Authenticated (Shop Manager+) Privilege Escalation to \u0027page\u0027 Parameter"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-109381",
    "datePublished": "2026-10-28T06:45:05.954Z",
    "dateReserved": "2026-10-12T14:24:43.392Z",
    "dateUpdated": "2026-10-28T16:10:34.580Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

CVE-2026-17166 (GCVE-0-2026-17166)
Vulnerability from cvelistv5
Published
2026-07-29 01:29
Modified
2026-07-29 12:56
Severity ?
4.3 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
CWE
Summary
The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings — including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses — that govern how all event bookings are processed.
References
Impacted products
Vendor Product Version
magepeopleteam Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar Version: 0   ≤ 5.3.7
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-17166",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-07-29T12:55:30.373486Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-07-29T12:56:46.107Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP \u0026 Event Calendar",
          "vendor": "magepeopleteam",
          "versions": [
            {
              "lessThanOrEqual": "5.3.7",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "Wordfence PRISM"
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The Event Booking Manager for WooCommerce \u2013 Sell Tickets, Event Registration, RSVP \u0026 Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access and above, to modify site-wide payment settings \u2014 including WooCommerce payment enablement, cart redirect behavior, login requirements for checkout, confirmation page ID, and confirmed ticket statuses \u2014 that govern how all event bookings are processed."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 4.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-862",
              "description": "CWE-862 Missing Authorization",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-29T01:29:41.941Z",
        "orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
        "shortName": "Wordfence"
      },
      "references": [
        {
          "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/5f43e35e-55cd-45f1-b8a5-e47398d97cc2?source=cve"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php#L1120"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php#L1080"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/tags/5.3.7/admin/settings/global/admin_setting_panel.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php#L1120"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php#L1080"
        },
        {
          "url": "https://plugins.trac.wordpress.org/browser/mage-eventpress/trunk/admin/settings/global/admin_setting_panel.php#L25"
        },
        {
          "url": "https://plugins.trac.wordpress.org/changeset?reponame=\u0026old=3625494%40mage-eventpress\u0026new=3625494%40mage-eventpress"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-07-24T18:17:13.000Z",
          "value": "Vendor Notified"
        },
        {
          "lang": "en",
          "time": "2026-07-28T13:23:18.000Z",
          "value": "Disclosed"
        }
      ],
      "title": "Event Booking Manager for WooCommerce \u003c= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599",
    "assignerShortName": "Wordfence",
    "cveId": "CVE-2026-17166",
    "datePublished": "2026-07-29T01:29:41.941Z",
    "dateReserved": "2026-07-24T18:02:01.608Z",
    "dateUpdated": "2026-07-29T12:56:46.107Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}