Ovatheme Events Manager WordPress Plugin Unauthenticated Arbitrary File Upload Vulnerability

A vulnerability allowing arbitrary file uploads has been identified in the Ovatheme Events Manager plugin for WordPress, affecting all versions through 1.8.5. The issue arises from inadequate file type validation in the process_checkout() function, enabling unauthenticated attackers to upload arbitrary files to the server, potentially leading to remote code execution.

Impact

Exploitation of this vulnerability could allow for unauthorized file uploads, which may be executed remotely, depending on the nature of the uploaded file.

Remediation

Users are advised to update the Ovatheme Events Manager plugin to version 1.8.6 or later.