The plugin contains a function that hooks into the user capability filter and, without validating the requested screen, grants the manage_options capability whenever the page parameter begins with certain prefixes such as mep_ or mpwem_. This CWE-269 flaw allows an authenticated actor who already has the Shop Manager role or higher to elevate their privileges to Administrator by appending a crafted page query string (e.g., ?page=mep_x) to any admin URL. The escalation grants full control over site settings, user management, and potentially all content, representing a significant confidentiality, integrity, and availability risk.

The vulnerability affects the Event Booking Manager for WooCommerce plugin from magepeopleteam, in all versions up to and including version 5.7.8. No other vendor or product is listed as susceptible.

The CVSS score of 7.2 indicates a high severity flaw. Because the exploit requires only authenticated access and no additional network privileges, an attacker who can log in as a Shop Manager can immediately leverage this weakness. The EPSS score is not available, but the lack of a KEV listing does not diminish the risk; the flaw is still poised for exploitation by any user with sufficient access. The attack vector is purely local/administrative, requiring the attacker to log into the WordPress admin interface and append the page parameter to an authorized URL. The vulnerability is not mitigated by default security controls and is actively exploitable if the outdated plugin remains installed.