Unrestricted upload of files with dangerous types is present in Ovatheme Events Manager plugin version 1.8.4 and earlier. The flaw allows an attacker to upload files that are not properly validated, enabling the delivery of malicious content that can be executed or interpreted by the server. This violation of file‑type validation privileges an attacker to inject code or data that can compromise the confidentiality, integrity, or availability of the affected WordPress site. The issue corresponds to CWE‑434, a classic input validation weakness.

Ovatheme Events Manager is a WordPress plugin that provides event‑management features. Every installation of the plugin with a version up to and including 1.8.4 is vulnerable. The flaw resides in the plugin’s file‑upload feature, which is used by site administrators and possibly by front‑end users depending on the plugin configuration.

The CVSS base score of 10.0 indicates the highest severity. The EPSS score of less than 1% suggests that exploitation is not widespread at present, and the vulnerability is not yet listed in CISA’s KEV catalog. The CVE description indicates arbitrary file upload is possible; it is inferred that an attacker may exploit this remotely via the upload endpoint, typically through a web form. The CVE does not state whether authentication is required; if the upload endpoint allows unauthenticated access, the attack surface may be large. It is inferred that successful exploitation could lead to remote code execution.