Medium severity6.5NVD Advisory· Published Nov 8, 2025· Updated Apr 15, 2026

CVE-2025-7663

Description

The Ovatheme Events Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in the /class-ovaem-ajax.php file in all versions up to, and including, 1.8.6. This makes it possible for unauthenticated attackers to delete ticket files, download tickets, and more.

Affected products

WordPress/Ova Events Managerinferred
Range: <=1.8.6
Package: https://wordpress.org/plugins/ova-events-manager
WordPress/Events Managerllm-fuzzy
Range: <= 1.8.6
Package: https://wordpress.org/plugins/events-manager

Patches

Vulnerability mechanics

References

themeforest.net/item/em4u-event-management-multipurpose-wordpress-theme/20846579nvd
www.wordfence.com/threat-intel/vulnerabilities/id/53f12e61-fdb0-4838-b733-fc4d7a4ff016nvd

News mentions

No linked articles in our index yet.

cvss	0.423
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000