Ovatheme Events Manager Missing Authorization Vulnerability

A vulnerability exists in the Ovatheme Events Manager plugin for WordPress, all versions through 1.8.6, due to a lack of proper capability checks in the class-ovaem-ajax.php file. This oversight allows unauthenticated users to gain unauthorized access, potentially leading to the deletion of ticket files, unauthorized ticket downloads, and other malicious actions.

Impact

Exploitation of this vulnerability could result in unauthorized access, allowing attackers to delete ticket files and download tickets without proper authorization.

Remediation

Users are advised to update the Ovatheme Events Manager plugin to version 1.8.7 or a newer patched version.