Threats tagged 'ghsa-g289-qjmf-x2p6'

The Mage Eventpress plugin for WordPress versions up to and including 5.7.8 contains a privilege escalation vulnerability. This flaw arises from the mep_grant_shop_manager_access() function, which improperly grants the manage_options capability when certain request parameters match specific patterns, without validating them against registered EventPress screens. Authenticated users with Shop Manager-level access or higher can exploit this by appending crafted query parameters to admin URLs, thereby elevating their privileges to Administrator.