The Ovatheme Events Manager plugin contains a missing capability check in several functions within its AJAX handler file, allowing any user, including unauthenticated visitors, to perform privileged operations. An attacker can trigger these functions to delete ticket files or download ticket data, resulting in loss or exposure of sensitive event information. The flaw is classified as a missing authorization control (CWE-862).

All released versions of Ovatheme Events Manager up to and including 1.8.6 are affected. The plugin is a WordPress component that can be installed from the theme marketplace or WordPress repository. Users running any of these versions on their website are at risk until they upgrade or remove the plugin.

The base CVSS score is 6.5, indicating moderate severity, while the EPSS indicates a very low but nonzero likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Because the flaw enables unauthenticated access through public AJAX endpoints, an attacker who discovers the exposed URL paths could exploit the issue without needing to authenticate. The potential impact includes deletion of ticket files and unauthorized disclosure of ticket content.