What is the CVSS score of EUVD-2025-18546?

EUVD-2025-18546 has a CVSS 3.1 base score of 10.0 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Wordpress Plugin are affected by EUVD-2025-18546?

A critical file upload vulnerability in Ovatheme Events Manager (versions up to 1.8.4) allows attackers to upload and execute malicious files, potentially leading to complete system compromise.

How to fix or mitigate EUVD-2025-18546?

Within 24 hours: Disable the Ovatheme Events Manager plugin or restrict file upload functionality to administrative users only; implement immediate monitoring for suspicious file uploads and web shell activity. Within 7 days: Audit all uploaded files for malicious content; isolate affected systems if compromise is suspected; establish air-gapped backups. Within 30 days: Monitor vendor communications for patch availability; prepare migration plan to alternative event management solutions if patch timeline is unclear; conduct security assessment of systems that may have been compromised.

Wordpress Plugin EUVD-2025-18546

| CVE-2025-32510 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2025-06-17 audit@patchstack.com

WordPress File Upload Wordpress Plugin

10.0

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

10.0 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Re-analysis Queued

Apr 23, 2026 - 15:42 vuln.today

cvss_changed

EUVD ID Assigned

Mar 14, 2026 - 22:15 euvd

EUVD-2025-18546

Analysis Generated

Mar 14, 2026 - 22:15 vuln.today

CVE Published

Jun 17, 2025 - 15:15 nvd

CRITICAL 10.0

DescriptionCVE.org

Unrestricted Upload of File with Dangerous Type vulnerability in Ovatheme Ovatheme Events Manager allows Using Malicious Files.This issue affects Ovatheme Events Manager: from n/a through 1.8.4.

AnalysisAI

CVE-2025-32510 is an unrestricted file upload vulnerability in Ovatheme Events Manager versions up to 1.8.4 that allows unauthenticated attackers to upload malicious files, achieving remote code execution and complete system compromise. With a perfect CVSS 10.0 score, network-accessible attack vector, and no authentication required, this vulnerability poses critical risk to all exposed installations. Exploitation is trivial and requires only HTTP requests.

Technical ContextAI

This vulnerability stems from CWE-434 (Unrestricted Upload of File with Dangerous Type), a class of file handling flaws where an application fails to properly validate file types before storage and execution. The Ovatheme Events Manager plugin, a WordPress events management extension (CPE: ovatheme:events_manager), implements file upload functionality without adequate type validation, file extension whitelisting, or execution prevention in upload directories. Attackers bypass client-side and weak server-side filters to upload executable files (PHP, JSP, ASPX, etc.) to web-accessible directories, enabling arbitrary code execution within the application's security context. The vulnerability affects all versions from initial release through 1.8.4, suggesting the flaw existed from the feature's inception.

RemediationAI

Immediate Action: DISABLE the Ovatheme Events Manager plugin immediately via WordPress admin dashboard (Plugins > Deactivate) until patch availability is confirmed Detection: Scan web server upload directories (typically /wp-content/uploads/) for recently created executable files (.php, .phtml, .php3, .php4, .php5, .phar, .shtml, .jsp, .jspx, .jsw, .jsv, .jspf, .aspx, .asp, .cer, .asa) with creation/modification dates after plugin installation Forensics: Review web server access logs (Apache access.log, Nginx access.log) for POST requests to upload endpoints and subsequent GET requests to suspicious file paths created within upload directories Web Application Firewall: If plugin must remain temporarily active, implement WAF rules blocking file uploads with executable extensions and restricting access to upload directories to known-safe file types only File System Hardening: Configure upload directories with PHP execution disabled (via .htaccess 'php_flag engine off' for Apache, or location blocks for Nginx) to prevent execution of uploaded malicious files Patch/Upgrade: Monitor Ovatheme security advisories and WordPress plugin repository for patched versions above 1.8.4; apply immediately upon availability Alternative: If vendor does not provide timely patches, replace Ovatheme Events Manager with actively maintained alternatives (e.g., The Events Calendar, Eventbrite, or Caldera Forms)