CVE-2025-7663 is a missing authorization vulnerability in the Ovatheme Events Manager plugin for WordPress. The issue arises from the absence of proper capability checks on several functions in the /class-ovaem-ajax.php file in all plugin versions up to 1.8.6. This allows unauthenticated attackers to access sensitive operations like deleting ticket files and downloading tickets without proper permissions. The vulnerability is classified under CWE-862 and has a CVSS 3.1 score of 6.5, reflecting a medium severity impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

The vulnerability allows unauthenticated attackers to delete and download ticket files managed by the plugin, potentially leading to unauthorized data access and disruption of event ticket management. The confidentiality and integrity of ticket data are impacted, but availability is not affected. There are no known exploits in the wild as of the published date.

No official patch or fix is currently available for this vulnerability as per the provided data. Users should monitor the vendor's advisory channels for updates. Until a fix is released, consider restricting access to the affected plugin files or disabling the plugin if feasible to mitigate risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.