CVE-2025-7663CWE-862broken-access-control

CVE-2025-7663

Medium · published November 8, 2025

CVSS v3.1
6.5
EPSS
0%
Percentile
11.6
In the wild
Unconfirmed
What it is

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00218 · 11.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2025-11-08T09:15Z
References (2)
https://themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579 · [email protected]https://www.wordfence.com/threat-intel/vulnerabilities/id/53f12e61-fdb0-4838-b733-fc4d7a4ff016?source=cve · [email protected]
EPSS history
Timeline
  • 08 NOV 03:27Z
    Ovatheme Events Manager <= 1.8.6 - Missing Authorization
    cvelistv5