PT-2025-45554 · WordPress · Ovatheme Events Manager

Friderika Baranyai

·

CVE-2025-7663

·

Published

2025-11-08

·

Updated

2025-11-08

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Ovatheme Events Manager plugin for WordPress versions through 1.8.6
Description The Ovatheme Events Manager plugin for WordPress is susceptible to unauthorized access. A missing capability check on several functions within the /class-ovaem-ajax.php file allows unauthenticated attackers to perform actions such as deleting ticket files and downloading tickets.
Recommendations Update the Ovatheme Events Manager plugin to a version later than 1.8.6.

Fix

Missing Authorization

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-7663

Affected Products

Ovatheme Events Manager