PT-2025-25674 · Ovatheme · Ovatheme Events Manager

Bonds · Published 2025-06-17 · Updated 2025-07-30 · CVE-2025-32510

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ovatheme Events Manager versions 1.7.5 and earlier

Description The issue allows for the unrestricted upload of files with dangerous types, enabling the use of malicious files.

Recommendations For Ovatheme Events Manager versions 1.7.5 and earlier, as a temporary workaround, consider restricting file uploads to only allow safe file types until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2025-32510

Affected Products

Ovatheme Events Manager

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-32510 · Security Note
• https://twitter.com/CVEnew/status/1934999208538329582 · Twitter Post
• https://patchstack.com/database/Wordpress/Plugin/ova-events-manager/vulnerability/wordpress-ovatheme-events-manager-plugin-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://patchstack.com/database/wordpress/plugin/ova-events-manager/vulnerability/wordpress-ovatheme-events-manager-plugin-1-7-5-arbitrary-file-upload-vulnerability?_s_id=cve · Note
• https://t.me/cveNotify/130231 · Telegram Post