Ovatheme Events Manager CVE-2025-6553

Exploitation requires that the target WordPress site have the Ovatheme Events Manager plugin installed and active at version 1.8.5 or earlier, and that the checkout/booking flow reaching the vulnerable process_checkout() function be accessible to anonymous visitors (the typical configuration for an event-registration/checkout feature). No authentication, privileges, or user interaction are required per PR:N/UI:N. The primary limiting factor is deployment: only sites running this specific commercial plugin are affected, so the realistic exposure is bounded by the plugin's niche installed base rather than by any attacker-side prerequisite. Successful RCE additionally depends on the uploaded file landing in a web-executable path where PHP is served.

This is a genuinely high-priority flaw, not merely a high-CVSS paper tiger. The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N) describes network-reachable, low-complexity exploitation with no privileges or user interaction, and the CWE-434 arbitrary-file-upload primitive in process_checkout() plausibly leads to remote code execution - a worst-case impact profile (C:H/I:H/A:H). However, the signals are mixed on likelihood of mass exploitation: EPSS is only 0.76% (54th percentile), which is modest and suggests no broad automated exploitation wave is currently observed, and there is no CISA KEV listing and no indication of public exploit code. The low EPSS despite a 9.8 score is best explained by limited product footprint (a commercial ThemeForest theme plugin) rather than any weakness in the vulnerability itself. Note a minor consistency caveat: the description says RCE 'may' be possible rather than confirmed, so the I:H/A:H impact rests on the file-upload-to-webshell assumption typical of CWE-434 - defenders should treat RCE as likely-but-not-vendor-confirmed. Net: patch promptly where this plugin is deployed, but widespread opportunistic exploitation is less likely than the raw score implies given the niche installed base.

An unauthenticated attacker locates a WordPress site running the Ovatheme Events Manager plugin (<=1.8.5) and submits a crafted checkout request that invokes process_checkout(), which fails to validate the uploaded file type. The attacker uploads a malicious PHP file (web shell) to a web-accessible location and then requests it to execute arbitrary code on the server. No public exploit code is identified at time of analysis, but the attack is low-complexity given AV:N/AC:L/PR:N/UI:N.